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1 . FLOW CHART SYMBOLS 

Flow charts shown in this report conform to American National Standard 
X3. 5-1970, "Flow Chart Symbols and Their Usage in Information Processing". 
Symbols of interest are defined below. 


Process: Computation, storage move, etc. 



Input/Output 


Comment,- annotation 


On-line storage (e.g., disk) 


Decision 



Predefined process, subroutine 
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SECTION 1 
j SUMMARY 

This report presents the final results of the Hardware Verification Task, 

Task 1 c 0 , of the Simulation Verification Techniques Study. As noted in Section 3, 
the objective of this task was to define software and hardware techniques for 
checking the operational .status of the various subsystems anticipated in future 

NASA training simulators. This Task was implemented by the execution of three 

> 

basic subtasks consisting of the definition .of expected simulation hardware. 

Subtask 1.1, a survey of current self test techniques'. Subtask 1.2, and the de- 
finition of specific techniques applicable- to the various simulator subsystems. 
Subtask 1.3. This report presents the results of all three subtasks. 

Section 3 reviews the basic objectives of the various subtasks while Section 4 
reviews the groundrules under which the overall task was conducted and which 
impacted the approach taken in deriving techniques for hardware self test. The 
results of the first subtask, the definition of simulation hardware are presented 
i.n Section 5. The hardware definition is based primarily on a brief review of 
■the simulator configurations anticipated for the Shuttle training program. How- — 
ever, these subsystems virtually encompass the full range of simulator subsystems 
currently being implemented for modern training simulators. 

The results of the survey of current self test techniques. Subtask 1.2, are 
presented in Sections 5 and 6. . Section 5 reviews the data sources that were 
considered in the search for current techniques while Section 6 presents the 
results of the survey highly condensed and structured in terms of the specific 
types of tests that are of interest for training simulator applications. Spe- 

i 

cifically, these types of tests are readiness tests, fault isolation tests and 
incipient fault detection techniques. The most applicable techniques have been 
structured into software flows that are then referenced in subsequent discussions 
of techniques for specific s.ubsys terns. 

The results of the third and major subtask, the definition of hardware and 
software techniques. Subtask 1.3, are presented in Section 8. In this section 
each of the major simulator subsystems is addressed specifically and the 
techniques for implementing the self test of these subsystems are treated. The 
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simulator subsystems consist of the ancillary digital computers and their inter- 
faces, the data, conversion equipment, controls and displays for the crew station 
and the instructor operator stations, visual simulation subsystems, the motion 
base subsystem and several items of miscellaneous equipment. 

The integration of the various subsystemstests is addressed in Section 9. 

This section primarily reviews the scope of the hardware and software requirements 
if all of the subsystem tests defined in Section 8 are implemented and also 
considers the type of software structure or executive that' is required for fully ■ 

automating these tests. Finally the overall aspects of the software requirements 
in terms of data base impact and the sensitivity of the self test systems to 
simulator changes are discussed. 

The conclusions and recommendations derived from the considerable effort 
expended in the execution of the Hardware Verification Techniques Task are 
presented in Section 10 . • In addition to the references listed in..Section 11, 
an extensive bibliographic listing is included in the appendices. 
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SECTION 2 
INTRODUCTION 

This report presents software and hardware techniques for implementing simulator 
hardware self test as defined during the Simulation Verification Techniques. Study 
being conducted for NASA's Johnson Space Center under Contract NAS9-13657. This study 
is being- performed by McDonnell Douglas Astronautics Company - East at its McDonnell 
Douglas Technical Services Company - Houston Division. Keith L. Jordan, Simulation - 
Development Branch, FSD, is Technical Monitor of the contract for- the NASA. 

* ’ i 

The Simulation Verification Techniques Study is one of a number of studies 
recently conducted by NASA-JSC in support of the development of training and pro- 
cedures-development simulators for the Space Shuttle Program. The other studies have 
included the following: Shuttle Vehicle Simulation Requirements Study, NAS9-12836; 

Space Shuttle Visual’ Simulation System Design Study, NAS9-12651, performed by 
McDonnell Douglas Electronics Company; Development of Simulation Computer Complex, 
NAS9-12882; and Crew Procedures Development Techniques, NAS9-13660. The last two 
of these were performed by McDonnell Douglas Astronautics Company - East. 

The present study, the Simulation Verification Techniques Study, consists of 
two major Tasks. These are the Hardware Verification Task and the Performance 
Verification Task. The present report is the final report for the Hardware 
Verification Task. This report summarizes' the techniques found useful for simulator 
hardware verification and describes the software and hardware provisions that are 
required for implementing these techniques for the various simulator subsystems. 
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SECTION 3 

HARDWARE VERIFICATION TASK OBJECTIVES 

The- objective of Hardware Verification Task was to define software and 
hardware techniques for checking the operational status of all simulator equip- 
ment anticipated in future NASA simulators. These techniques will determine 
the state of equipment readiness, identify incipient failures, and provide for 
fault isolation to a repairable of replaceable piece of equipment. This Task 
required the definition of anticipated simulator hardware, the survey of current 
self test techniques, the definition of parameters characterizing simulator 
subsystems and replaceable components, the definition of techniques -for acquir- 
ing data representing these parameters, the definition of processing requirements 
for determining hardware status, and the collective integration of data acqui- 
sition and processing requirements into the context of a simulator configuration. 

3.1 SUBTASK 1.1 - DEFINITION OF SIMULATION HARDWARE 

The objective of this subtask is to survey current spacecraft and the 
current Shuttle vehicle, as well as state-of-the-art spacecraft and aircraft 
simulations to determine the hardware that may be required for implementation 
of future spacecraft, real-time simulations. 

SUBTASK 1.2 - SURVEY OF CURRENT HARDWARE SELF TEST TECHNIQUES 

The objective of this subtask was to survey current and near-future self 
test methods and practices in order to establish' what can be accomplished within 
the current state-of-the-art. 

SUBTASK 1.3 - DEFINITION OF HARDWARE AND SOFTWARE TECHNIQUES FOR SIMULATOR CHECKOUT 
The objective of this subtask was to define software and hardware techniques 
for checking the operational status of all simulator equipment. In addition, the 
techniques developed shall provide for fault isolation to a piece of repairable 
or replaceable equipment. This task requires the definition of parameters 
characterizing the outputs of subsystems and components; the definition of anti- 
cipated failure modes for components and subsystems; the development of means 
for sensing the performance parameters and transmitting them back to a computer 
for processing; and the definition of processing requirements, for verifying 
proper performance as well as. for isolating faults to a defective unit. 
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SECTION 4 

GROUNDRULES AND ASSUMPTIONS 

The Simulator Verification Techniques study was conducted in accordance 
with the .groundrules established by the contract statement of work. This section 
discusses those groundrules and their significance in carrying out the study 
effort. Also discussed in this section are some assumptions that' were made in 
the course of the study and which were necessary to- concentrate our effort in 
developing a self test concept. 

The study groundrules were listed in the study statement of work as 
follows: _ - . 

1. The design of hardware or software used for checkout shall be such 
as not to endanger personnel or equipment by its use or through 
malfunction. 

• 2 . .. ..Malfunction of the self-check hardware shall not hinder normal oper- 

ation of the simulation. 

3. The design of hardware or software used for checkout shall minimize 
human intervention. 

4 . The checkout techniques shall make maximum use of the simulation 
and its computer to perform the checkout. 

5 . The checkout and verification techniques shall minimize the require- 
ments on computer resources . • ' 

6. The checkout time shall be minimized. 

Safety of personnel and equipment is a primary consideration in the design 
of aerospace systems. Addition of self test capabilities to these systems must, 
therefore, be consistent with safety requirements of the basic system; in parti- 
cular, special care must be exercized in the design -of self test system elements 
so that a failure in any of these elements would not endanger training or operating 
personnel, or .the basic equipment or facility being used. 

The main objective of incorporating a self test capability in a simulator is 
to increase availability of the system. Availability is a function of reliabil- 
ity and mean time to repair. If the addition of self test elements degrades 
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reliability or maintainability of the system, the objective of self test is defeated 
Therefore-, seif test elements added must be made a part of the system in such a. way 
that a failure of any of these elements would not interfere with basic system 
operation; also, mechanical and functional integration should not interefere with 
accessibility of operational components in any way that’ time to repair would' be 
increased. 

In keeping with the objective of increasing system availability by addition of 
a self test capability, it is mandatory that the amount -of time required to exercise 
this capability be held to a minimum. Manual activities generally to be longer 
times than automated activities. Wherever possible, therefore, the self test 
process should be carried out by automatic means that minimize human operator 
intervention. 


The hardware and software resources available for command and control functions 
in a simulator are quite extensive and powerful. These resources are in heavy 
demand during complex simulation sequences but are relatively idle at other times. 

In order to minimize design, development, and manufacturing cost, it is desirable 
that no self test oriented hardware or software elements be added to the system 
when an already existing element of the basic simulator can perform a similar 
verification task. Consequently, use of the simulator host computer and aucillary 
computers has been assumed for test control and execution functions. 

Programming and operation of a large Host Computer, such as the type of equip- 
ment envisioned for Shuttle Simulators, are quite costly in terms of man-hours and 
equipment required. During simulator development, as well as during operational 
phases, computer time availability is likely to be limited either because of 
software development requirements or training requirements. The software 
structures considered for test software have been generalized and modularized to 
minimize both the development and operational demands for computer resources. 

The time required for hardware checkout is a critical factor in determining 
how often the tests of the hardware can be exercised. We have assumed the adequacy 
of end to end readiness tests for daily, pre-run testing and have structure the 
software for timely implementation of these types of tests. This has separated ou? 
the operations required for fault isolation, when necessary, as well as incipient 
fault detection. 
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SECTION 5 

DESCRIPTION OF SIMULATOR HARDWARE (SUBTASK l.T)- 

, A large amount of data has been reviewed to establish the types and quanti- 
ties of hardware components and the most likely arrangements or configurations 
anticipated on near future NASA simulators. In order to develop hardware verifi- 
cation concepts on a realistic and useful basis, it is useful to define a set of 

* * i 

components of interest, and the relative quantities and likely configurations of 
these components at least within subsystems or stringsc-:of- hardware. This has been 
accomplished by the definition of a simulator Reference' Configurations described 
in this section. The study activities related to the Hardware Verification Task 
address the implementation of self test ideas within the context of this Reference 
Configuration. In summary, the Reference Configuration establishes the following 
aspects of the hardware verification task: 

• The specific hardware component level to which verification techniques 

will be carried -■ • • 

t - The specific component types to be considered ' 

« The' typical configurations of components within" subsystems or strings 

• The simulator facilities expected to be -available for implementation of 
automated verification techniques (i.e., minicomputers, test stations, 
data paths, etc.) 

The Reference Configuration was established by using the schematic diagrams 
assembled for each of the upcoming Shuttle training simulators and component lists- 
for these simulators. This information was used to establish the top level con- 
figuration shown in Figure 5.0-1, and to define an extensive component listing 
with appropriate descriptive data. The list is presented in Appendix A and is 

t 

discussed in the following paragraphs. Section 5.1 reviews the top level aspects 
of the Reference Configuration. Section 5.2 reviews the details of the subsystem 
configurations with appropriate schematic diagrams. 

5.1 REFERENCE CONFIGURATION 

The Reference Configuration shown incorporates all of the major elements 
anticipated for the forthcoming NASA Shuttle training' simulators. The arrange- • 
ment of the flight computer, interfaced directly to the host computer, is typical^ 
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also of such simulators as the SLS, the MCAIR F-15 engineering development simula- 
tion- in St. Louis, anticipated configurations of Shuttle software development 
simulators, and the Shuttle Avionics Integration Laboratory,- SAIL. The use of a 
minicomputer to off-load display processing for a graphics system is expected for. 
the SMS -and has been done for the Flight Simulation laboratory at MCAIR. For 
the SPS graphics display processing will be done on the XDS 930. 

The crew station, IOS, visual displays and motion base are driven by a 
single minicomputer as proposed for the Shuttle Mission -Simulator’ in Reference 5.1-1 
However, no impact on the results of this study is foreseen for a different 
arrangement. The approach taken effectively analyses the verification of the 
minicomputer and its interface to the host computer as one set or string of hard- 
ware. The subsystems driven by the minicomputer are then approached. individually 
with no interference expected between the verification techniques for the separate 
subsystems. The software requirements established will , therefore, be available 
for implementation in either the minicomputer or the host computer dependent only 
on the particular configuration being tested. 

5.2 SUBSYSTEM REFERENCE CONFIGURATIONS 

The hardware verification techniques were developed by addressing realistic 
configurations of subsystem hardware and components. This approach places more 
importance on the nature of the subsystem configurations than on the configuration 
of the overall simulator. Consequently, in this section, the subsystem configura- 
tions are described. and defined to more detail than for the overall simulator 
configuration. 

5.2.1 Host Computer Complex 

The Host computers for simulators of interest to this study are major 
scientific computing systems. Maintenance of these systems is provided on a 
regularly scheduled basis by the computer vendor or other contractor. Effective 
and efficient maintenance is a continuing concern of major importance to the 
major computer vendors. Consequently, large digital computer checkout technology 
is beyond the scope of this study. The study emphasis was therefore placed on 
that particular hardware peculiar to simulator systems and for which there has 
been limited past effort directed toward development of automated checkout features. 
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5.2.2 Minicomputers or Other Ancillary Computers 

Minicomputers have been incorporated increasingly within many large simulator 
configurations as their technology becomes more advanced and economical. However, 
the function that the minicomputer or ancillary computer performs is not of any 
consequence when the problem of verifying the hardware interface and the mini- 
computer mainframe is addressed. The parameters or characteristics' *6 f primary 
concern are the word sizes of the host and minicomputers, the data word formats, 
the parity checking and control signal requirements. 'These parameters are unique 
to each particular installation and do not impact the conceptual approaches that 
are taken to establish proper functioning of the mini and its interface once -the 
assumption is made that the host computer and its data channel are functioning 
properly. 

Consequently, the problem addressed for this specific hardware is the 
requirements for software to verify that the minicomputer and its interface are 
functioning properly. This requirement differs from the general vendor's main- 
tenance requirements to isolate faults within a computer system. The functional 
software requirements are established without definition or limitation to a 
specific configuration. 

5.2.3 Crew Station 

The crew station configuration is of importance to the hardware verification 
task only with respect to the components in the crew station. That is, the 
components in the crew station do not interact between each other but represent 
the terminations of data paths going to or from the host computer and routed 
through the data conversion equipment. The configuration of the data conversion 
equipment is, therefore, the pacing consideration in defining the crew station 
and IOS checkout process. Consequently, the crew station configuration is defined 
only by the control and display components listed in Appendix A. The list consists 
mainly of components anticipated for the Shuttle Mission Simulator. However, 
the component list is also representative of the Horizontal Flight Simulator 
from a verification viewpoint. There are no components or quantities in the 
Horizontal Flight Simulator that present verification problems not encountered 
in the reference configuration. 
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Simulator instruments are implemented with either actual flight hardware ( 
or simulated flight hardware. The simulated flight instrument consists of 
flight instrument exteriors with the insides modified to accept analog DC inputs-. 
Synchro/resolver drive circuitry .and DC circuitry are both included in the . 
■reference configuration. 

5.2.4 Instructor/ Operator Station 

The components that comprise the instructor/operator station are: also 

shown in Appendix A. The basic unit of communication with the system, from the 

\ 

instructor station is the CRT graphics displays and keyboards. CRT displays and . 
keyboards provide maximum flexibility both for monitoring and for introducing 
inputs. Fault insertion can also be accomplished through these graphics terminals. 
Mode select switches are provided for additional computer inputs. Instrumentation 
and displays that duplicate crew station hardware are assumed wired in- parallel 
directly from the crew station. Panels are provided for monitoring hand controller 
positions, communications and recording, and simulator status, including visual, 
motion base, computer, DCE, lighting, and sound. Television monitors are also 
provided for monitoring the out-the-w-indow scenes. 

The verification requirements for instruments in the instructor/operator 
station are assumed identical to those in the crew stations. 

5.2.5 Data Conversion Equipment 

Verification requirements for the data conversion equipment are particularly 
configuration sensitive. Consequently, a complex data conversion system structure, 
typical of the Shuttle Mission Simulator,- has been expanded to a level of detail 
which shows schematically- the component arrangements down to the Least Replaceable 
Unit, LRU, level. 

• The data conversion equipment between the host computer and simulator is 
shown in Figure 5.2-1. A minicomputer functions as a control processor between 
the data conversion equipment and the host computer. The minicomputer buffer 
enables the host computer to transfer its data in continuous blocks at the 
beginning or end of a time frame and- thus minimize interrupt processing by the 
host computer. 
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The muni-computer to anadog/digital interface shown in Figure 5.2-2 provides 
data distribution between- the minicomputer and the data conversion components. 

This interface generates the device addresses and provides the signal conditioning 
as the data words are- transmitted serially to/from the minicomputer. -The inter- 
face also decodes the addresses and routes output signals and multiplexes input 
signals to/from the data conversion components. The data conversion components 
include analog-to-digital converters with input multiplexers, digital-to-analog 
converters, and data line drivers and receivers. Appendix A lists the quantities 
and characteristics of these components. 

* * i 

The data conversion equipment also includes digital storage, digital multi- 
plexers, address decoders, lamp and flag drivers , line drivers and receivers, and 
signal conditioning for the simulator controls and displays which are assumed to 
be located on the simulator. Locating this equipment on the simulator adds line 
drivers and receivers but drastically reduces the number of cables between the 
simulator- and interface equipmejjt. The data paths between the- simulator and the 
analog/digital interface for the various types of signals are shown in Figure 
5.2-3, 5.2-4, 5.2-5 5.2-6- and 5.2-7. 

5.2.6 Visual Systems Configuration ’ 

The visual systems analyzed for automated verification techniques are 
represented schematically in Figure 5.2-8. This configuration encompasses basic 
electronic and electro-mechanical components, anticipated for near future visual 
systems. The orbital earth model incorporates those servo, optical , and TV 
•systems also required for implementation of star fields with a star ball. A 
change of scale in the flat earth model does not change the servo or TV system 
configuration requirements although the hardware performance specifications may 
be reduced as opposed to a terminal area model system. Checkout requirements for 
the computer image generation system are not affected by the type or mix of scenes 
generated. The remaining functions verified are the TV controls and video mixing 
and distribution units. Testing of these units are addressed as part of the 
visual systems checkout problem. Component descriptions may be found, in the 
component table. Appendix A. 
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Three methods for implementing servo systems are considered. These methods 
are commonly used on all types of simulators and consist of the following: 

• A DC analog system. Figure 5.2-9 

• A. digital system wi'th digital encoders for position feedback. Figure 5.2-10 

• A 400 hz synchro/resol ver system. Figure 5.2-11 

5.2.7 Motion Base System 

Survey of various simulator installations, both for aircraft and spacecraft, 
reveal a preponderance of hydraulic driven motion platforms. Electrical motion 
systems are more common where large displacement and accurate positioning are 
important factors, such as in model and camera visual systems, or in the 100 . 
foot lateral displacement motion base of the Flight Simulator for Advanced Air- 
craft- at NASA-ARC. 

Studies .performed for NASA- JSC for baseline hardware definition of Shuttle 
simulators, (Reference 5.2-1) have reinforced the concept that a moving plat- 
form powered by hydraulically driven actuators has advantages over other 
possible drive schemes. These advantages are especially attractive in mass 
movement capability, range of displacement, and velocity and acceleration 
capabilities within the facilities envelope allowed for the simulator, while 
meeting the simulation requirements for the various flight regions of the Shuttle 
vehicle. 

The motion base system configuration used for reference in this study is a 
si x-degree-of- freedom, synergistic actuator,' hydraulic system. A detailed 
description of this configuration is shown in Section 8.5.1 . Figure 8.5-1 
shows the actuator arrangement used to drive the motion platform, while Figure 
8.5-2 presents the hydraulic system layout for providing kinematic drive for 
this platform. 

5.2.8 Flight Hardware and Interface 

The flight hardware of concern for purposes of simulator reference configura- 
tion definition includes: 

• Three flight computers 

• A mass memory device 
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• The onboard graphics CRT displays 

• The keyboard for flight computer entries 

• The display electronics unit that provides interface services between 
the flight computers and the keyboard and displays 

In the simulator, this hardware is interfaced to .the HOST computer by means 
of the Flight Hardware Interface Device. In the actual Orbiter, the flight 
computers interface with various Shuttle systems. In the simulator, elements 
of these systems or their functions are simulated in the HOST computer. This 
variety and complexity of functions places a heavy demand in rate and data 
handling versatility at thrTtOST to flight hardware interface. The FHID provides 
this versatility, while at the same time providing time generation and time 
tagging functions for flight data handled by the flight computer. Figure 5.2-12 
shows the equipment arrangement and interfaces for the flight hardware used in 
the Reference Simulator Configuration. 
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SECTION 6 

DATA SOURCES FOR SURVEY OF CURRENT HARDWARE- SELF TEST TECHNIQUES 

Initial efforts of the Simulation Verification Techniques Study focused 
on-obtaining information regarding the techniques currently being used in 
simulator -verification. This section summarizes the results of the survey in 
terms of the data sources that were sought out or contacted for information 
of interest to the present study. Section 7 presents the self test techniques 
found to be pertinent to simulator applications.' Self test system data sources 
surveyed included simulator developers and users, as. well as the literature of 
relevant technology areas. 

6.1 SIMULATOR USERS/DEVELOPERS 

Requirements for hardware self-test techniques as well as past experience 
vary widely with simulator users at least partly as a function of the basic 
nature of the simulator activity with which they are concerned. Aerospace 
simulators of interest to this study may be grouped into the following four 
categories: 

o Spaceflight training simulators 
o Military training simulators ' . 

o Commercial airline training simulators 
o Engineering development simulators 

Spaceflight training simulators as developed and utilized in the past at 
Johnson Space Center represent the most sophisticated and complex simulators 
assembled for any purpose. This complexity derives in part from the complexity 
of the vehicles being simulated and in part from the fidelity of the simulation 
required. The* stringency of the fidelity requirements is imposed by the fact 
that spacecraft crews, up until now, have not had the opportunity for any actual 
flight training in the vehicles they are to fly, prior to the time of their 
operational flight or mission. 

Military training simulators are currently being procured in increasing* 
numbers as an economy measure to conserve both fuel and money, since these 
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simulators are used' for crew training functions previously accomplished during 
flight training phases of crew training programs. As a consequence, the fidelity 
requirements for these simulators seem to be increasing and motion base require- 
ments and visual display requirements are becoming more sophisticated. 

Commercial airline training simulators have also increased in fidelity in 
recent years. The objective of fidelity improvements for these simulators is- 
to reduce crew flight training hours required for transition training'to new.„. 
aircraft. Airline simulators probably have as high a utilization factor as 
any simulators in use. ' 

Engineering development simulators are a standard tool for todays' air- 
frame developers and manufacturers. The use of simulators for development 
and advanced development purposes is also promoted at NASA's Ames Research 
Center, Mountain View, California. 

Simulation. facilities and/or simulators reviewed or visited during survey 
activities are summarized in Table 6,1-1. The general nature of the. facilities 
and their activities is described further in the following paragraphs: 

6,1.1 Spaceflight Training Simulators •' • • 

The spaceflight training simulators reviewed were basically the simulators- 
at JSC although a visit was made to the MSFC facilities. Specifically, the 
NASA JSC simulators included in the survey were the Command Module Simulator 
(CMS) and the Lunar Module Simulator (LMS) in Building 5; the Skylab Simulator 
(SLS) in the same building; and the Command Module Procedures Simulator and the 
Lunar Modules Procedures Simulator in Building 35. - 

1 

The Command Module Simulator (CMS) is the oldest simulator at JSC; as such, 
it employs very little checkout hardware or software. Softv/are diagnostics 
are used for the DDP computers, which have also been modified with a "traceback" 
register to aid post-crash diagnosis. All other checkout and maintenance is 
implemented by straightforward manual methods. 
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FACILITY' 

LOCATION, 

CONTACT 

EQUIPHENT/ACTIVITIES 

Flight. Simulation Lab. 
Flight Sj Guidance 
: Simulation Lab. 

N. 

Ames Research Center 
Moffett Field, .California 

Ooe Rathert 
Chief,. Simulation 
Science Division 

18 different installations, four of which 
are, considered major, and supporting com- 
puters' and interface equipment. These in- - 
elude a 6 degree-of-freedom motion base 
with -automated checkout software; additional 
5 and $ degree of freedem motion bases; 
visual systems; four hydraulic control loader 
systems for force feel simulations; aircraft 
sound simulators. 'Equipment used for re- 
search and development. 

Car-nutation Lab. 
Computer and 
Simulation Division 

Marshall Space Flight 
Center, 

Huntsville, Alabama 

Frank VI nz 

EAI 8900 Hybrid Computer, System, 6 Degree- 
of-freedom motion base Jterrairi models, 
visual displays, etc. No specific activity 
in automated checkout. 

Avionics Laboratory; 
riunan Resources Lab; 
Flight Simulation Branch, 
Training and Checkout 
Division. 

Wright Patterson AFB 
Ohio 45433 

Col. Scolatti, 

Jim Henderson 
Art Body 

Numerous simulators for both training and 
R&D.;-. Activities include procurement of AF 
simulators, specification of validation, 
verification, reliability and maintain- 
ability requirements. Work on Development 
of “Morning Readiness Test" concept. 

Naval Training 
Ecuiptnent Center 

Orlando, Florida 

F. R. Cooper 

1 F-4 simulator for research and development. 
Primary activity is procurement of train- 
ing equipment including simulators. Ad- 
vanced work done on checkout of visuals and 
; . yehicle-dynami cs simulation to isolate faults 
. between visuals and the aircraft simulation. 

i 

Computer Simulation 
Facility 

i 

Naval Air Development 
Center 
Warminster, 
Pennsylvania 

Bob Jones 

A number of large hybrid simulators. Two 
CDC 6600 ’s share extended memory. Four 
DADI05 units for interface. .Simulators -used 
for engineering development. No new or sop- 
histicated checkout techniques in develop- 
ment. 

American Airlines 
Flight Academy 

Ft. Worth, Texas 

1 

R. D. HCLure 
Hgr., Simulator 
Technical Support 

Training simulators for 727, DC-10, EAC 
1-11. Simulators operational 16 hours/day 
Maintenance and checkout primarily on .third 
shift-Pre-training test run for daily check- 
out. 

Flight Training Center 

United Air Lines 
Denver, Colorado 

Dale Seay 
Mgr., Simulator 
Operation 

. Training simulators for 727, DC-10, 747, 
■ - 0C-8.Haintai nance on third shift. 

Paner on performance verification 

presented at A1AA symposium. 

US-F F-15 
Simulator 

MCAIR 

St. Louis,, Missouri 

Ken Kuny - 

Two Datacraft 6024 's will be used to 
drive simulator including simulation 
of the flight computers. Reliability/ 
maintainability requirement specified. 

WX Flight 

Simulation 'Laboratory 

MCAIR, MCAlfTO 
St. Louis, Missouri 

Roger Mathews 
Steve Rayhawk 
Gene Brown 
Frank Brown 

CDC 6600 supports a variety of engineering 
development simulations. Equipment "include 
swinging arm motion base; dual cockpit air 
combat simulator. No formal verification or 
hardware checkout activity. 

ICCC Training 
Simulators . 

MDEC, 

St. Louis • Missouri 

Howard Barnes 
Bill Borin? 
Tnra Franz 
John Mackey 

MDEC has developed simulators for the 
A-7D and DC-10 most recently. The A-7D 
uses a morning readiness test. 


TABLE 6.1-1 SIMULATION VERIFICATION TECHNIQUES STUDY 
SIMULATION FACILITY SURVEY SUMMARY 
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The Lunar Module Simulator (LMS) was reviewed but no special checkout 
techniques were found to be in use for this simulator. 

i 

The Skylab Simulator (SLS) began as a MOL simulator for the Air Force, 
and. therefore has. ex.tra-cost features which make hardware checkout very conven- 
ient. The hardware and software architecture allows maintenance personnel to 
decouple an individual functional unit from the system and diagnose that unit 
with built-in stimulus/response hardware, while the rest of the 'simulator system 
operates normally. 

* 

Until recently, the Command Module Procedures Simulator (CMPS) and Lunar 
Module Procedures Simulator (LMPS) shared the CDC 6400 host computer. The 
Shuttle Procedures Simulator (SPS) currently under development also uses the 
CDC 6400, augmented by XDS 930 and 9300 computers. Three distinct hardware 
checkout programs have been developed for the CMPS and LMPS. These are PSALT, 
GREMLIN, and QUIKCHEK. The self test functions implemented with these software 
packages are summarized in Table 6.1-2. 

6.1.2 Military Training Simulators . • ' • 

Current military simulator procurements show the effect of the Complete 
Cycle Cost (C ) philosophy common in other military procurements. As a result, 
specifications for new simulators include highly formalized requirements for 
configuration management, documentation, initial verification and validation, 
hardware checkout, reliability, and maintainability. To a great extent, the 
specifications simply define requirements, leaving it to the contractor to 
develop the techniques to satisfy these requirements. 

The USAF specification for an F-15 training simulator as an example, calls 
for an MTBF of 90 hours and an MTTR of one-half hour. This corresponds to an 
availability of 99.4%., In the area of methods to, achieve this low MTTR, the 
specification includes high-level- requirements for access panels,. test points, 
and software diagnostic/exercise routines. • . 

The principal sources contacted for information on military simulators were 
the F-15 simulator procurement being managed by McDonnell Douglas Aircraft Compand 
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TABLE 6.1-2 EXISTING FSD CHECKOUT SOFTWARE 


PROGRAM NAME 

HARDWARE TESTED 

CHECKOUT FUNCTIONS 

PSALT .(PROCECUPES SIMULATOR 
ANALOG LINKAGE TEST) 

SEE BELOW 

o EXECUTIVE CONTROL OF FLINT, TAMS, SWORD, CDT, 
AND EQPCK. 

0 CDC 211 (CRT TERMINAL) OPERATOR INTERFACE, 
o CDC 6400 SCOPE (OPERATING SYSTEM) INTERFACE, 
o PRINT OUTPUT. 

o MISCELLANEOUS MONITORING AND DISPLAY FUNCTIONS. 

FLINT ( FUNCTION LINK 
INTERPRETER) . 

DCE: A/D, D/A, 
AND DISCRETE I/O 

o SELECTION OF INPUT AND OUTPUT SIGNAL PATHS. 

0 REPETITIVE OUTPUT OF OPERATOR-SUPPLIED TEST 
■ STIMULI m COMPARISON WITH EQUIPMENT 
RESPONSE (USING OPERATOR-SUPPLIED TOLERANCE). 

o FAULT DETECTION AND ERROR- FREQUENCY COUNT. 

o DISPLAY AND PRINT FAULT-DETECTION RESULTS. 

o FAULT ISOLATION (IN COOPERATION WITH TEST 
OPERATOR). 

TAMS (TEST ANALOG MODE 
SELECT) 3 

EAI 231 R (ANALOG 
COMPUTER) MODE 
CONTROL ADAPTER 
(MCA) AND ANALOG/ 
• DIGITAL LINKAGE 
. CONTROLLER (ADLC) 

o COMMAND EACH MODE OF THE ANALOG COMPUTER; 

CHECK WHETHER DESIRED MQOE WAS SELECTED. ' 

o TEST MCA ALARM SIGNAL. 

0 TEST ADLC CLOCK START/STOP. 

o TEST STATUS OF DATA CHANNEL. . 

0 GENERATE APPROPRIATE ERROR ALARMS. 

SWORD (STATUS WORD - 
DIAGNOSTIC) 

LINK STATUS WORD 
(12-BIT REGISTER 
USED BY PERIPHERAL 
PROCESSOR) 

0 COMMAND SET/RESET Or EACH INDIVIDUAL BIT OF 
THE LINK STATUS WORD; CHECK FOR PROPER RESPONSE. 

o TEST REPETITIVELY; GENERATE AND DISPLAY ERROR 
, COUNT. 

CUT (CLOCK DIAGNOSTIC TEST) 

ADLC CLOCK (HARDWARE 
INTERVAL TIMER) 

0 TEST CLOCK START/STOP RESPONSE. 

o TEST CLOCK RESET MODE. 

0 TEST CLOCK CAPABILITY TO GENERATE OATA- 
TRANSFER PULSES. 

o TEST CLOCK FREQUENCY COUNT AGAINST CDC 6400 
INTERNAL CLOCK. 

EQPCJC (EQUIPMENT CHECK) 

DISPLAY HARDWARE IN 
END-TO-END CONFIGU- 
RATION, INCLUDING 
ASSOCIATED DCE (D/A, 
A/D, D/R, ETC.) 

o APPLY OPERATOR-DEFINED CONSTANT SIGNALS TO 
D/A OR A/D CHANNELS. 

o APPLY SINE OR TRIANGULAR WAVE TO D/A 
CHANNELS. 

. 0 DRIVE DISCRETES OH/OFF AT A SPECIFIED RATE, 
o CYCLE DIGITAL READOUTS OVER ALL DIGITS. 

0 DRIVE D/R CHANNELS AT A SPECIFIED RATE. 

0 SET D/R UNITS TO A SPECIFIED ANGLE. 

AOG (AVERAGE DEVIATION GRAPH) 

A/D AND D/A 
CALIBRATION 

0 SELECT D/A AND A/D SIGNAL ROUTING, 
a DRIVE EACH CHANNEL THROUGH A ±128 VOLT RANGE, 
o DISPLAY CALIBRATION CURVES. 

0 GEHERA7E ALARM FOR EXCESSIVE DEVIATION. * 


* TAPS IS NOT IN USE AT, PRESENT. 
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it. Louis; and the information available from the Naval Training Equipment Center , g 
Orlando, Florida. NTEC manages the procurements of many of the simulators acquired 
for the Navy and Marine training programs and is also involved in certain Army 
procurements as well. 

6.1.3 Commercial Airline Simulators 

Airlines are highly cost-conscious in their approach to training simulator 
procurement and operation. Their management demands, and achieves, high avail- 
ability of simulation equipment with straightforward manual methods (e.g., 

/ 

man-in-loop preflight) and few checkout aids. Airline personnel' interviewed 
stated that the key to simulator maintenance is simply "good people". Looking 
at their recent operating history (generally, 99% or better availability), they 
see little need for any automation of checkout. However, when pressed, they 
concede that they had significant "teething" problems when their current simu- 
lators were new. 

In one respect, airline simulators are. well suited to incorporation of 
automatic checkout techniques. That is, their configurations and operational 
procedures are very stable and well controlled. Countering that, however, is 
the fact that to reduce initial cost, airline simulators are very centralized, 
and allow small space and time reserves in the central computer. This would 
make it rather difficult to retrofit checkout hardware and software. Only 
one airline simulator with mass storage and overlay capability was identified. 

When a particular simulator subsystem presents a downtime problem, the 
tendency is to improve maintenance procedures, change spares provisioning 
policies, and/or redesign the equipment to achieve higher reliability, so 
that the subsystem will not require as much maintenance. 

Principal sources contacted for information on airline activities were 
American Airlines Flight Academy, Ft. Worth and the United Air Lines facilities 
In Denver, Colorado, both of which were visited by study personnel. 
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6.1.4 Engineering Development Simulators 

Engineering simulators ^considered in this study included simulators 
built up to support a particular aircraft or spacecraft design project (such 
as the Space Shuttle, DC-10 or F-15), as well as multi-user simulation faci- 
lities intended to support a number of different aircraft or spacecraft 
development programs (such as the Flight Simulation Facility at MCAIR and the 

Simulation Sciences Divis-ion of NASA-Ames ) . \ 

'4 

i 

The major obstacle to implementation of advanced checkout techniques on 
such simulators is the steady stream of changes to the simulator hardware and 

» 

software. Typically, the simulator support staff has difficulty just keeping 
up with the changes and capability improvements requested by the using group(s), 
leaving little time to devote to incorporation of checkout features. 
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6.2 BIBLIOGRAPHIC DATA SOURCES • - 

The present state, of the literature in the field of automatic test "equipment' 
was aptly described in Reference 6.2-1, in September of 1974. 


' "Because testing "has become a rather specialized field with its own in 
jargon, most .engineers whoi are', confronted 'with a 1 testing- assignment -may •' 
not be able to assess' the entire testing problem.. The problem is com,- 
pounded further by the non-existence of a unified body of knowledge in 
the form of tutorial texts on automatic testing; hence the engineer must 
wade through voluminous and not so easily digested technical journals" 
before finding something that can be readily applied. The Engineer's 
most frequent compromise, therefore, is to take what is available com- - 
mercially (after an inexhaustive study of the field) and tailor what- 
ever he buys to fit the product -that is to be tested. As a result, there 
is a tendency to buy ATE haphazardly or build the whole ATS from scratch 
with great expenditure of time and money." 


The absence of an -integrated,, cohesive literature oh the broad area of automatic 
testing prompted us, even during our self sponsored studies, to establish sub- 
ject indexed reference lists in an attempt to organize literature of interest. 

In the present study, we have extended these early results to bring them up 
b date and to make them more- useful to the reader. 

The results of literature surveys are presented in the Appendices to this 
report. Appendix ‘B contains a glossary of terms particularly useful in the area 
of simulator self test techniques. In Appendix C, we have attached a comprehensive 
bibliography of material which we'have reviewed during or before^this study. In 
the- first part of the bibliography, the source documents are referenced by subject 
matter. In the second part of the bibliography, the documents are listed in more 
complete bibliographic form, alphabetically, by authors’ last name. 
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SECTION 7 

■ RESULTS OF SURVEY OF CURRENT HARDWARE SELF TEST TECHNIQUES - 

Generic techniques for hardware self test that are of particular potential 
interest to simulator users and developers are presented in this section. 

These techniques are limited to those the simulator user might apply himsel-f 
to various simulator subsystems as opposed to very.- sophisticated and es.o.teric. 
techniques that would be'of primary interest to more specialized subsystems, 
manufacturers. An example of the latter is the digital ‘logic simulations 
often used by computer manufacturers further discussed in paragraph 7.1. 1-1. 

The techniques of interest to the present study fall into the following 
three major categories: ‘ • 

9 Test design 
i Test implementation 
9 Test data processing 

Test design techniques are primarily influenced by the objective of the - 
Nest being designed. The tests for which design techniques have been considered 
include fault detection tests, fault isolation tests and incipient fault 
detection tests. 

Test implementation techniques are concerned with the means of generating 
and' inserting test signals, into the hardware being tested at the proper points 
to accomplish the test objectives. Jest implementation is also concerned with 
the acquisition of the .required test data. The latter problem becomes one of 
-either sensing a parameter that is difficult to measure or switching a signal 
without introducing an additional failure point into the hardware being tested. 

Test data processing is that processing that is required to manipulate the 
data acquired from the test in order to make it reveal the information that is 
required in fulfillment of the test objectives. Test data processing, in 
some of its forms, is a heavily documented problem area. Unfortunately, some 
of the more mundane, though more useful techniques in this area, are hardly 
documented at all. 
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Test design techniques are discussed in Section 7.1, test implementation 
^techniques in Section 7.2, and data processing techniques in Section 7.3. 

TEST DESIGN TECHNIQUES ^ 

Test design techniques are methods and processes that can be used to 
accomplish one or more of the following: 

• Identify a test approach for a subsystem 

, / . ■ - > 

• Develop a test sequence 4 ,1. s _ 

• Establish test signal requirements „ i 

• Identify characteristic parameters for correlation of test results 
Test design techniques are Highly dependent on the objective of the test being 
designed as well as on the basic type of hardware being tested. Consequently, 

-in this section, we have addressed the basic types of tests of interest to this 
study. These three types are readiness tests, whose primary objective is fault 
detection; fault isolation tests, and incipient fault detection test techniques. 

Readiness tests are discussed in Section 7.1.1 in terms of the various 

hardware categories to which they may be applied. Fault isolation test 

^discussions are organized similarly in Section 7.1.2. Incipient fault detection 

tests discussed in Section 7.1.3 are addressed in terms of the various approaches 

that have been identified for implementing an incipient fault detection capability. 
* 

7-l*l Readiness Tests (Fault Detection) 

Readiness tests are used to verify the rea.diness of simulator subsystems 
to perform according to design and operational requirements. Generally these 
tests check each of the simulator subsystems and, whenever possible, use 
already verified subsystems to check other subsystems of the simulator. 

Ideally, readiness tests, ar.e end to- end tests. They are primarily concerned 
with testing a complete string of hardware. ' 

In order to implement an end to end test for.a hardware subsystem and 
arrive at any degree of confidence as to its proper operability, it is generally 
necessary to first consider the likely failure modes of the hardware and the 
symptoms of those failures. For an end to end test this requires the identi- 
fication of some manifestation of the failure that is going to be apparent at 
the end of the hardware string at which the data acquisition process will be 
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implemented. 

Once the failure modes, and, symptoms are recognized, then' it is logical 
to try to identify the characteristic parameters that will enable detection 
of the failures being tested for. The characteristic parameters are not 
necessarily quantities that. are being sampled directly by the data acquisition 
system. For example, the data acquired may be the position. of' a device as a 
function of time. The characteristic parameters for evaluating the system- 1 s 
performance may be rise time, peak overshoot and settling time. The necessary 
operations between the data, acquired- and the characteristic parameters repre- 
sent the data processing discussed in Section 7.3.* 

Test design techniques contribute directly to the identification of 
symptoms of faults as well as to selection of characteristic parameters for 
readiness testing. Test design techniques depend heavily on the type of 
hardware being considered. Consequently, the remaining discussion is organized 
in terms of the basic hardware types considered. These three types are digital 
electronics, analog electronics and electro-mechanical systems. 

7. 1.1.1 Digital Electronics (Fault Detection) 

■ Digital circuit elements are, found in a. simulator in the data conversion - 
equipment, the host computer and flight computers as well as the devices 
which interface the computers of various types. Some of these interfaces are 
themselves computers. • 

Failures of digital circuit elements manifest themselves in one of three 
different modes; 

- • Constant logic 1 output, unable to switch to a logic 0 

t Constant logic 0 output, unable to switch to a logic 1. . 

® Output which does not represent the inputs and is intermittently erroneous 
The failure may occur in data storage or in gating circuitry. In this case the 
accuracy of calculations is affected. * On the other hand, a failure may develop 
in address generation or recognition circuitry. This type of error causes data 

or commands to be. routed to improper devices, or not to be transferred at all. 

The first case may not be immediately recognized, but, instead may be processed 


7-3 


/VICDO/V/VtLL DOUGLAS ASTfrOMAUTICS COJMFVl/VV' - EAST 



MQC tlisu 
' 1 November 1 974 

having the same effect on the system as that caused by presenting wrong data to 
the right device. 

The limited choice of failure modes at the logic level belies the complexity 
of the problems, both of detecting and isolating faults in digital circuit 
elements when combined into the major simulator subsystems previously noted. 

, * ’ . * i 

These problems arise because of the logical complexity of the circuits any 
time a substantial path length is considered. As a consequence it is entirely 
possible and frequently likely for the hardware logic structure to effectively 
conceal faults from casually designed functional tests of the basic functional 
units. For example, exercising all of the hardwired instructions in a computer 
and checking the answer of the combined operations may or may not reveal the 
presence of a fault. The reason this can occur is that for any particular 
combination of numbers to be processed, there may be bit cells that remain 
unchanged during the process or whose values are dropped during round off 
operations. 

There is a solution to this test design problem. That solution is the 
fate level simulation of the entire digital logic circuit in the string. With 
the proper simulation, it becomes possible to insert faults at any critical 
point identified, simulate a test and evaluate whether the test detects that fault 
and propagates it in a manner that can be discerned in the test results that are 
produced. 

» * 

Unfortunately, the gate level simulation of digital circuits is a large 
and sophisticated undertaking that is best left to the manufacturers of .digital 
circuits. Not' only is the required effort substantial, but the talent required 
is sophisticated, and in addition, if a major computing system is involved in* 
the path, the problem of obtaining an accurate representation of the computer’s 
operation is itself a major -undertaking. This is due to the proprietary 
importance of this very detailed information on the operation of a vendor's 
computer system. This latter factor also encourages assignment of the diagnostic 
development task for digital equipment to the people who make it. 
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Nevertheless, there is a .’limited amount of action that may be taken- by the 
simulator user for implementation of readiness tests. . This action is the 
l^iecifi cation of diagnosticj software capabilities as part of computer and digital 
system procurements. The form that any such specification may take is 
necessarily functional. For example, it is relatively easy to specify the 
provision of test software to test all memory cells for their ability to assume 
both true and false conditions; and to exercise the hardware instruction set not 
only for numerical results but also for timing which may also be revealing; and' 
to exercise communication paths to assure that all bits, both data, address, and 
parity, and in ter -subsystem communication are being transmitted and received 
correctly. The functional tests required in any specific application may be • 
directly derived from the device's operational requirements. The availability 
of this software can never give a one hundred per cent confidence level that 
all of the hardware is functioning properly but it can give a much higher level 
than no test at all. In addition, depending on the hardware in question, the 
manufacturer may be able to specify what per cent confidence may be realized 
from exercising certain specific parcels of his self test software as part of 
a daily readiness test. 

7. 1.1. 2 Analog Electronic Circuits (Fault Detection) 

Analog electronic circuits are found in the data conversion equipment, 
the televisions systems for the visual simulation, and in the aural simulation. 
Analog circuits do not generally exhibit the logical complexity that is found 
in digital circuits. As a‘ consequence, it is usually possible to identify 
characteristic parameters that are effective in- evaluating the circuits on -an 
end to end basis for readiness testing. 

Failure modes of ana.log circuits can be cataloged and because of the large 
variety of component types to be considered the catalog would be. extensive. For 
purposes of designing readiness tests it is simpler and more efficient to 
consider the basic nature of electronic equipment of this type. The electronic 
subsystems we are concerned with for the simulator hardware environment consist 
of a number of lower level modules that are considered for self test purposes- 
to be LRU's or Least Replaceable Units. For purposes of readiness testing 
we are concerned with verifying the proper operation of a relatively simple 
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arrangement or collection of these LRU's which might also be described as 
^'black boxes." These boxes as well as the subsystems into which they are 
integrated have fairly well defined functional performance specifications. 

The objective of the readiness test can then readily be interpreted to be the 
verification that these subsystems or LRU's are performing per their performance 
specification. This effectively amounts to direct identification of character- 
istic parameters for the subsystems or LRU's with only an intuitive 
consideration of their potential failure modes. 


Typically the choice of the characteristic parameters which are likely 
to be of interest for measurement in a self test system is relatively limited 
and will consist of some combination of the following: 

• Bandwidth 

— • Signal/Noise Ratio 

• Linearity 

' • Amplitude and phase response versus frequency 

• Sensitivity 

'• Differential gain 

|fiany of these parameters may be incidental properties of the circuit or 
because of the circuits functional purpose, they may be performance criteria 
and consequently, for test purposes, they become characteristic parameters 
'Of primary importance. 

* Since the input as well as the output of an electronic circuit is basically 
-ah' electrical signal, the specification of characteristic parameters is the major 
“part of the readiness test problem aside from some possible switching require- 
ments. The stimulus is readily generated with electronic signal generators and 
the output or response is acquired as another electrical signal ready for 
•processing. 

~ 7.1.1. 3 Electro-Mechanical Systems {Fault Detection) 

Electro-mechanical systems are found in simulators in many subsystems. 

These subsystems include the galvanometer and servo driven meter movements in 
the crew station and IOS, as well as the model drives for the visual simulation, 
and the electro-hydraulic motion base servo systems. These systems are all 
applications of classical control theory design techniques and are susceptible 
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to analysis and testing using, the concepts of modern control theory. \ 

* 

Readiness tests for these .systems are again only concerned- with determining 
whether the overall end' to' end performance of the unit or subsystem is within 
performance specifications. • In the case of electro-mechanical systems it is 
desirable to look at the malfunction modes and the associated symptoms that 
characterize the system-. .This analysis, serves two purposes. It heTps 'to define, 
the characteristic parameters 'Which* are required-to reveal any extent malfunctions 
and it also helps to assure that determination of those characteristic parameters 
by testing is necessary for the purpose- of detecting any potential faults. 

r 

Hydraulic motion base systems are an interesting case in point in this 
regard. It is possible to directly instrument many of the properties of the 
motion base that need to be checked. For example, line pressures, reservoir 
levels, pressure drops,, etc. This direct instrumentation enables verification 
of these parameters during static checks. Unless other failure modes, which 
cannot be tested statically, are considered essential for daily testing, there 
is no requirement to -implement an additional dynamic test although the motion 
^ase system is a straightforward easily tested hydraulic feedback control system. 

f 

Control systems whose performance can be analyzed at least approximately 
.by conventional linear control theory are generally evaluated dynamically in 
terms of their response to several basic input signals. These- common test 
signals are the unit impulse, the step* the ramp, and the parabolic input. 

These signals represent different alternates for assessing the transient 
response of the system. Frequency response measurement is an alternative 
to transient response analysis. The frequency response of a system is defined 
as the steady state response of the system to a sinusoidal input signal. 

.The most common means for specifying the time domain or transient 
performance of a control system is in terms of its response to a step input. 

The response of a typical underdamped second order system to a step input is 
shown in Figure 7.1-1. This figure has been used to identify or define the 

♦ i 

common, time domain, performance parameters. These are the rise time or time 
to 100 per cent of the commanded value. For an overdamped system, there is no 
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overshoot and the rise time is defined with reference to some fixed per cent 

i — 

^,f the full deflection, for example 10-90 per cent. The remaining parameters 
*%r the underdamped system are the per cent overshoot, the time of peak 
overshoot, and the settling time. The settling time is' the time required for 
'the response to become damped within some nominal boundary of- .the commanded 
value. Use may also be made of the residual s’t'eady-state error. : 

Although the parameters described above are defined for a linear, second 
order system, the wide spread use of these parameters is- due to the fact- that 
for many higher order and/or nonlinear systems, the dynamic response is quite 
often primarily impacted by a pair of dominant roots. Consequently, the 
response of these systems is not entirely different from that shown in 
Figure 7.1-1. 


Readiness testing of electro-mechanical systems, when dynamic tests are 
necessary, should be adequately addressed by evaluating the parameters described 
above following the application of a step input as a stimulus. Frequency 
response testing should almost always be unnecessary for this purpose. One 
jfeason for this is. that there is a certain amount of correlation between the 
frequency response of a system and its transient performance. For example, 
loss of' high frequency'response will show up in the degradation of rise time. 
Similarly, the magnitude of the per cent overshoot, also relates to the 
magnitude of the resonant peak amplitude response in the frequency response 
characteristics. 

The utility of determining the response to a step input of dynamic 
systems is so great that a.utility routine has been flow charted for this 
purpose and for reference use in other parts of the study.' This flow chart 
is presented in Figure 7.1-2. 


The utility, step response test routine STRSP, shown in Figure 7.1-2 is 
based on the following assumptions as to its implementation and utilization: 
e The routine tests a block of devices whose scale factors and other 
characteristics are communicated to the routine in data arrays. 
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FIGURE 7.1-2 TRANSIENT RESPONSE TO STEP INPUT (STRSP) 
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s Time reference is provided by an external clock which is programmable 
to the .extent that it can be reset on command-. 

• The command for clock initialization and. the step signal magnitudes 
• • are. communicated to 1 the equipment being tested concurrently, making 
the clock an absolute time reference for the test. 

e The characteristic parameters determined by the test are communicated 

" * 

back to the calling-program in arrays also designated by that program. 

The cal ling- program is responsible for processing of the data generated’ by 

. * i 

the test routine, STRSP. For readiness tests this consists only of comparison 

* 1 

of the test results with nominal values and tolerances that are available, for 
this purpose. . • , '• 

7.1.2 Fault Isolation Techniques 

Fault isolation tests or procedures are either special tests or data 

analyses that are implemented for the purpose of identifying the failed unit 
in a system or subsystem. For the purposes of the present study we are 
concerned' with isolating failures to what we call the LRU level. An LRU is 
the last step in the automatic testing process once a fault has been detected. 

1 RU’s are defined by their natural modular nature and by the need at some point 
R remove a unit to a workbench to accomplish the ’final repair or replacement. 

r 

Ideally, it would be desired to perform further analyses on the data 
obtained from the readiness tests and establish the designation of the defective 
LRU. In subsystems in which LRU's are combined in circuits with any degree of 
complexity, this is seldom possible unless the functional performance of the 
LRU imposes a unique signature on the response obtained from the readiness test. 

There are simulator subsystems with many LRU's essentially arranged in 
parallel. In this instance readiness testing requires testing each of the parallel 
units and fault isolation is accomplished incidentally to the. readiness test. 
Subsystems of this type are crew- station and the instructor operator station. 

The fault isolation problem is also minimized when functional testing is 
implemented at the LRU level. For example, testing for the proper functional 
operation of a digital subsystem such as a data channel effectively isolates a 
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fault to as low a- level as it is desirable to go with a self- test system. 

, Like readiness tests,- fault -isolation tests are sensitive to the type of 
hardware being tested. The following' discussion considers digital electronic 
circuits, analog electronic circuits and electro-mechanical subsystems. 

7. 1.2.1 Digital Electronics ( Fault -I sol a ti tin) - ' 1 *' ' < t , ■ ■ ■ ■ 

The readiness testing of digital circuit subsystems is limited to -basic - 
functional testing in Section 5. 1.1.1. Functional testing in this instance 
involves exercising the basic functional elements of the digital subsystem such 
as the data channels, the interface hardware, the memory, the hardware 
instruction set, etc. Detection of a fault by any of these tests automatically 
identifies a faulty functional unit to the lowest level it seems necessary to- 
go for a simulator self test concept. 

. Techniques that are more suitable for manual or semi-automatic testing of 
digital systems include hardware probe insertion and the monitoring of discrete 
bits at certain key interface. points. Probe techniques require development 
j^ven for semi-automatic application and seem far beyond the scope of what should 
be attempted for a simulator self test system. 

The only techniques that seem useful and desirable for simulator implementation 
are functional- testing which effectively isolates faults to specific digital ---• 
functions and the use of intuitive or heuristic techniques for subsystems such as 
the data conversion equipment. _ 


7. 1.2. 2 Analog Electronics (Fault Isolation) 

Electronic equipment that processes basically analog signals is characterized’ 
by relatively simple arrangements of its LRU's. The characteristic parameters 
identified for end to end readiness testing of an electronic system are also 
applicable to testing of the LRU's Individually. The basic fault isolation 
problem for electronic systems is consequently solvable by introducing additional 
switching to enable testing of each LRU once the readiness test has detected a 
fault. This switching must of course be implemented in a fail safe manner. That 
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is, test circuit switch failures should not interfere with nominal simulator 
^perations. 

Although analog electronic systems configurations are basically less complex 
than digital logic networks, it may not always be possible or reasonable to rely 
on intuitive or heuristic techniques for derivation of the most effective or most 
direct test sequence for fault isolation. The techniques 'that are most useful 
and applicable to the test design problem for fault isolation in electronic systems- 
are graph theory and related modern network theory. Modern network theory and 
its relation to graph theory is very clearly presented .in Reference 7.1-1. 


The basic problem that these techniques can address is that of test design. 
Since we have restricted readiness testing to end to end testing, we must identify 
the test design problem addressed by these techniques to be fault isolation. The 
advantage of using these techniques is that they can identify methods for 
avoiding the necessity of- inserting test signals before each LRU and sensing 
response immediately past the LRU. In other words, the application of these 
j^echniques, When warranted, can potentially avoid the addition of switching 
to effectively enable testing each LRU individually. If the system is 
relatively simple, the necessary switching is not generally a problem. However, 
as the system complexity increases the switching requirements and the number of 
separate tests that are required can increase accordingly and reach a level where 
the application of somewhat more sophisticated test design techniques pay off. 

7. 1.2. 3 Electro-Mechanical Systems (Fault Isolation) 

Fault isolation for electro-mechanical systems is of primary interest with 
respect to the servo drives for the models and cameras in the visual simulation 
and for the motion base. The servo driven instruments in the crew station and 
the IOS are themselves LRU's and readiness tests effectively accomplish fault 
isolation at least to the level of interest for simulator self test. 

If the response to a step input is assessed as part of the readiness test 
■for these remaining systems, then some insight is already available as to the 
type of failure that is present. This insight is attributable to the fact that 
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Iche servo systems for the models and the motion base are relatively straight- 
forward control systems whojse transfer functions are known and whose performance 
is relatively linear and corresponds with what is predicted by linear control 
theory. 

This insight is available to the control systems engineer but not necessar- 
ily to the technicians or operators responsible for operation and/or maintainance 
of the equipment. Consequently, it may be desirable to implement additional 
■computerized analyses to provide the operator or maintainance crew with the same 
insight. There are several techniques well documented in the literature for* 
this purpose. These techniques are not very complex but because of the level 
of detail required with respect to particular subsystem description, it has 
not been feasible to carry out detailed example analyses for. simulator appli- 
cations. 

The fault isolation techniques for electro-mechanical systems that are 
|Of interest for simulator, applications are based on the further analysis of 
^the frequency response data for the tested systems. The following assumptions 
are implicit in both of these techniques: 

• The system' nominal transfer function is known 

• The system performs linearly in the region of the test 

• The system is relatively simple 

The requirement for relative simplicity cannot itself be delineated very ^precisely. 
However, as 1 the techniques are considered, the limitations on complexity should - - 
become evident. One interpretation of simplicity is that the systems performance 
be primarily governed by a dominant set of roots of the characteristic equation 
or effectively by a lower order dominant transfer function. This is simply the 
equivalent of saying that the presence of many higher order terms in the transfer 
function does not rule out the use of these techniques as long as the performance 
of the system is dominated consistently by the lower order roots and the others 
may be neglected. 

The two techniques to be described may be labeled the "transfer function 
coefficient derivation method" and the "frequency response pattern recognition method 
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Transfer Function Coefficient Derivation Method I 

) The frequency response of . a- system whose transfer function is known is 
readily .computed using basic control theory and may be plotted in a Bode diagram. 
The breakpoints in the linearized frequency response are, of course, at the 
frequencies -corresponding to the locations of poles or zeroes of the transfer 
function. The changes, in- slope of the amplitude response are governed by the 
following two properties: . . 

* At each simple pole or zero, there is a 20 db/decade change in slope 
[plus (+} for a zero, minus (-) for a pole] 

o At each complex pole or zero, there is 40. db/decade change in slope 
[again plus (+} for a. zero, minus (-} for a pole] 

The coefficient derivation method is based on analysis of the linearized 
or line segment approximation to the frequency response of the system as 
follows. If the breakpoints in this frequency .response are known (and they are 
readily computed) for the nominal system, then it is possible to select several 
test frequencies between each breakpoint and obtain the amplitude response by 
testing. From the test data, it is' possible to fit linear segments of the 
amplitude response between each breakpoint. The intersections of these linear 

i 

segments are now the new breakpoints of the system's transfer function." "Based 
on the sign of the change in slope at the breakpoint, the breakpoint 'frequencies 
may be inserted into the experimentally derived transfer function as either 
poles or zeroes. 

From an '“analysis of the system, the nominal numerator and denominator 
polynomials are known.. The coefficients of the terms in these polynomials are 
simple algebraic expressions involving the basic physical properties of the 
system. For example, these properties are gains, coefficients of friction, 
spring constants, etc. Once the actual transfer function is derived from test 
data, it is only necessary to solve the simultaneous algebraic coefficient 
expressions backwards dr inverted in order to determine what the values of the 
physical properties are currently. These physical property values may then be 
checked against the acceptable values and tolerances for these parameters to 
isolate to the characteristic that has degraded sufficiently to cause a failure , 
in performance level during the readiness test. * 
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The process for accomplishing this analysis, including the portion that 
may be implemented on the computer, is flow charted in Figure 5.1-3. Further 
|| information on the selection of test frequencies, as well as example problems, 
may be found in References 7.1-2 and 7.1-3. 

Frequency Response Pattern Recognition Method 

The coefficient derivation method' literally solved for the system proper- 
ties based, on its present performance. The pattern recognition method effectively 
accomplishes the same degree of isolation but on a more experimental basis. The 
results require substantially less computation during the development as well 
as after implementation. 

The pattern recognition method also considers the impact on the Bode 
diagram of changes in values of system parameters. The approach in this case 
is as follows. 

First, a limited set of test frequencies are selected, based on reference 
to the nominal frequency response properties of the system. Next the amplitude 
^and phase response characteristics of the system are determined for each test 
"frequency for some substantial deviation from the nominal value for each 
property that enters into the transfer function. . These parameters would again 
be gains, spring constants, friction terms, etc. The determination of the 
impact of the component deviation may be established analytically or by perform-* 
ing a small parametric evaluation with a simulation of the system. Knowing the 
effect on the amplitude and phase response, it is now possible to construct a 
table. The table can be constructed by listing the test frequencies along one 
side with provision for phase and amplitude characteristics at each frequency. 

The components of the system are listed across the other dimension of the table,* 
If components can fail with either positive or negative characteristic changes 
than both contingencies must be allowed for. Table 7.1-1 is an example of what 
such a table could look like. The table is filled out with whole numbers because 
the fault levels at the bottom of the table were divided into the phase and 
amplitude deviations and the result rounded to the nearest whole number. The 
same normalization can, of course, be done for the data obtained from a test. 
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TABLE 7.1-1 TYPICAL -FAULT DICTIONARY FOR A SIMPLE RC NETWORK*’ 


FREQUENCY 
RAD. /SEC. 


R T ; R 2 
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o 
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0= 
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’ 0 
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0 
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-1 

-1 
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1 

1 

0 
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0 

0 

-1 
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AMP RATIO 

0 0 

1 

0 

-1 

1 

1 

0 
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1 

-1 

-1 
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1 

1 

o 

1 

1 

o 
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0 

0 

-1 

-1 
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.1 

1 

0 

1 

1 

0 
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0 

0 

-1 

-1 
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0 0 

1 

1 

0 

1 

1 

0 
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-1 

0 ■ 

-1 

-1 

3000 • 
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0" 0 

1 

1 

0 

1 

1 

0 

0 0 

0 

0 

0 

0 
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o' * 0 

T 

1 

0 

1 

1 

0 

0 0 

-1 

0 

-1 

-1 


AMPLITUDE RATIO FAULT LEVEL 
PHASE ANGLE FAULT LEVEL 

“ * 
• 

025 

0785 

RAD. 








* This table, based on Reference 5-2, shows the patterns of performance 
deviations for ^ 50% component value deviations, in a simple RC network. 
Theround numbers appear because the actual_ deviations have been 
divided by the fault levels noted, and the results have been rounded 
to the nearest whole number. 
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' When the normalized data from a test is obtained, then the results at 
each frequency can be compared with the results obtained experimentally. This-, 
is an extremely simple computation and inmediately pinpoints the likely source 
of the fault. The question of multiple failures immediately arises and admit- 
tedly the approach as outlined is oriented toward single point failures. The 
coefficient derivation 1 method previously discussed does not have any limitations 
on the number of concurrent deviations that can be detected and would ; be a more 
appropriate choice if this situation is likely to occur frequently. 

* 

The pattern recognition technique ‘lends itself readily to the solution of 
simple problems and to small studies that assess alternate options or modifi- 
cations to. the basic techniques. Consequently, there are a large number of 
papers -that discuss this approach and its various ramifications at great length; 

Some of the more interesting discussions may be found in References 7 : T-2 : and 7.1-3 
A flow chart of the entire process is shown in Figure 7.1-4. 

frequency Response Analysis for Above Fault Isolation Techniques 

The two techniques discussed above are both based on further analysis of 
Bode diagram information. , The frequency response data for constructing a Bode 
diagram may be derived from tests' conducted in a number of ways. If one test 
frequency is applied at. a time and the response of the system measured, the data ■ . 
is ready for plotting immediately. However, if more complex signals are used 
to reduce test time, for example, or if normal operating signals are monitored 
for purposes of frequency response analysis, then certain data reduction tech- 
niques may be required. These techniques are discussed in Section 7.3: In 

the following Section, we 'address the problems associated with incipient fault 
detection. 
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FIGURE. 7. 1-4 FAULT ISOLATION BY FAULT DICTIONARY (FIFD) 
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7.1.3 Incipient Fault Detection Techniques 

| Readiness tests are .designed to detect existing 'faults in a system. A 
fault is an existing defect or deficiency which prevents the tested system 
from achieving a satisfactory performance level. An incipient fault is a 
fault that is likely to happen in the near future and whose occurence we would 
like to plan for. That- i-s, v/e would Tike to order replacement components or 4 
schedule maintenance at-- a time when it does not interfere with our -normal 
everyday operations. Since readiness tests are intended to be executed daily 
in order to assure proper operation of the simulator for the days tra-ining 
activities, it is most advantageous if we can concurrently acquire any addi- 
tional data that may be needed to obtain a warning of a fault about to happen, 
or at the least, look at the data obtained in a more quantitative sense than 
the simple go-no go condition. 

We have identified a number of basic techniques for detecting incipient 
faults. These techniques are applicable to all of the analog circuits and 
systems and to the servomechanisms in the various simulator subsystems. We 
have not found any techniques useful for digital electronics or for discrete 
'signal lines. The primary difficulty with discrete elements is that failure 
prediction techniques are in one way or another concerned with the performance 
degradations that may be observed, "With any system that exhibits only two states 
as opposed to a continuously varying, infinite variety of states, it is impossible 
to detect trends or gradations. 

Since the incipient fault detection techniques discussed are only applicable 
to analog electronics or electro mechanical systems, we have not organized this 
section by system type. Instead, we proceed directly to a description and 
evaluation of the various incipient fault detection techniques. These are 
overstress testing, marginal testing, gray area performance evaluation and 
degradation rate analysis. 

7. 1.3.1 Overstress Testing 

Overstress testing is based on the operation of the tested system or LRU 
at the high end or beyond the high stress limit of its operational band. The 
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jpverstress operation must, of course, be kept wfthin- safety limitations that 
are established for safe operation. For simulator applications, we are not 
so much interested in exceeding structural limitations, which is what the term 
stress tends to imply, but rather power limitations and possibly frequency 
limitations. ... . .... 

The bandwidth quoted for systems is conventionally taken to be the lowest 
resonant frequency of the system. If the system is only required to' have linear 
response out to that bandwidth, there may not be a performance level specified 
at the higher frequencies. However, testing in this area could be useful for 
incipient fault detection and could be considered as one type of overstress 
testing, although it would not be expected to induce any failures. 

More frequently, overstress testing might be applied in terms of excessive 
electrical power levels. Operation at higher than normal voltage levels can’ 
cause marginal components to burn out at a time when repair or replacement is 
more opportune. For simulator applications, this type of approach is more 
I 1 suitable for the regular maintenance shift when it is appropriate. There is no 
requirement for data storage or processing and no value in automation of the 
procedure. In addition, it- is definitely- an undesirable approach to- use as-* . 
part of a readiness test just prior to a training -session. 

7. 1.3. 2 Marginal .Performance Testing 

Marginal performance testing is based on operation of a system at a 
marginal performance level such that minor irregularities in performance may 
be revealed. Examples of this technique would be commanding an extremely low 
rate motion from a servo and then monitoring the servo response to detect 
irregularities in motion or the threshhold command levels required to stimulate 
a response. Either of these approaches should reveal high friction levels or 
potential motor degradations that could result in a subsequent failure. 

Marginal performance testing is in distinct contrast with readiness 
testing requirements. Readiness tests, as defined herein, are concerned with 
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(determining if a -system is. functioning properly. This implies .testing the. « .. 

I' ■ 

unit over its normal performance range, if not at its upper performance limits. 
Consequently, the use of marginal performance testing implies the execution of 
separate tests expressly for the purpose of incipient fault detection and of 
no value to the basic readiness test requirement. - - 

Although this type of testing must be recognized as one approach that 
can be implemented when nothing else will suffice, it is recommended, that either 
of the remaining two types of incipient fault detection techniques be applied 
first. Although directly applicable experience data is not available, it is 
anticipated that the following techniques will be adequate for future simulator 
subsystems. 

7. 1.3. 3 Gray Area Performance Degradation 

The simplest approach for incipient fault detection for either electronic 
(analog) or electromechanical subsystems is the detection of the fact that a 
subsystem has moved into a gray performance level margin- or boundary and its 
|) performance in the near future is likely to drop below acceptable levels. In 
order to do this, it is primarily necessary to store in the data base an addi- 
tional set of tolerances for each characteristic parameter. During the: readi- 
ness test performed before each training session, the units performance is 
compared not only with an’ absolute tolerance level which establishes the unit 
as failed, but the performance is also compared with a second tolerance which, 
if exceeded, says that the device is going to exceed its required performance 
limits within some predetermined time period, such as 10 or 30 days. 

The "gray area performance-" technique has some strong advantages, which 
include the following: 

• Data base requirements are minimized by the need to store only one 
additional tolerance for each characteristic parameter. 

• Computer software- development and computer computations are minimized. 

There. are also several disadvantages for the "gray area performance" tech- 
niques. These -disadvantages include the following: 
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• Complete knowledge of the systems performance degradation character- 
istics must be available before the technique can be implemented. 

• • The systems performance degradation characteristics must be predic- 

table and well behaved; otherwise either false warnings or "too late" 
warnings are likely to be received, 

• If the test .data analyzed are noisy or erratic on a day to day basis, 
false indications will be generated. 

The gray area performance degradation technique may be 'adequate for a number of 
reliable subsystems or components but, nevertheless, a more sophisticated tech- 
nique may be required. The final approach to be discussed resolves some of 'the 
difficulties mentioned above and has been designated the "degradation rate 
analysis technique". 

7. 1.3. 4- Degradation Rate Analysis Technique 

The incipient fault detection requirements for training simulators are 
oriented to relatively reliable subsystems or components. That is, we are 
concerned with units that may fail once or twice a year at the most, and for 
which failures we would like somewhere between 10 and 30 days warning. This 
time scale is of interest and a factor in predicating a degradation rate analysis 
technique inasmuch as it must be considered in determining over what sort, of .. 
elapsed time period data should be accumulated and retained for failure predic- 
tion. The accumulation of data, of course, impacts data base requirements. 

The degradation rate analysis technique- consists simply of storing perfor- 
mance data from day to day and each day reviewing the accumulated history of 
the units performance levels and using this information to predict a failure 
date. The most reasonable algorithm that suggests itself for processing the data 
is a least squares curve fit of a linear or first order curve. The daily sequence 
would proceed as follows; 

9 Execute readiness tests and store necessary performance characteristics. 

• Store data for degradation rate analysis by shifting all data points 
back one location in the data array in order to drop the oldest data 
point and make room for the new one. 

• Call a least squares curve fit routine to fit a linear curve to the 
total set of data. 
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• Check the slope of the resulting curve. If’ negative (performance 
decaying), continue. If positive, select a more recent set of data, 
i.e., the most recent half of the array. Repeat curve fit and slope 
check. 

t Extrapolate curve to find date at which unit performance will exceed 
its tolerance. 

t Check predicted failure date against warning require reference. 

• If failure is within critical period, print warning. 

This entire procedure is flow charted in Figure 7.1-5. 

- There are a number of advantages for this type of technique that are in 
contrast to the disadvantages of the previous approach. These consist of the 
fol 1 owi ng : 

9 The linear curve fit technique filters out perturbations that result 
from day to day test variations. 

t There is no need to know what the performance degradation history 
for a unit is likely to be. 

• There is no input data required that corresponds to the gray area 
tolerances of the previous method. 

o Experience acquired from this technique can be used to eventually 
implement the gray area technique and thereby conserve computer and 
data base resources. 

There are several disadvantages to this technique that should not be 
overlooked. These consist of the following: 

• Storage of data for any period (10, 20 or 30 days) impacts the data 
base requirements substantially. 

• The accuracy of the prediction, especially the timeliness, is going 
to be sensitive to the choice of sampling period. That is, a rapid 
ten day decline is going to be moderated by the curve fit if the data 
base goes back 30 days. 
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FIGURE 7.1-5 DEGRADATION RATE ANALYSIS FOR INCIPIENT FAULT DETECTION 
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Degradation rate analysis techniques require development for any units 
^to which they are applied. Although the computer resource requirements are 
large, they need not be large indefinitely, since well behaved systems may 
be converted. to the gray area technique as historical data is accumulated. 
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7.2 TEST IMPLEMENTATION TECHNIQUES 

Test implementation techniques are considered for the present report to 

(delude all of the techniques utilized in implementing a test that is required. 

to fulfill one of the objectives discussed in the previous section. These 

objectives are fault detection, fault isolation and incipient fault detection. 

Test implementation is an extremely broad subject if addressed generically in 

this context. Consequent! y- s the bulk of the test implementation analyses 

accomplished during the course of the present study are presented in the context 

of the particular systems addressed. That is, test implementation is 'the major 

concern in addressing data conversion’ equipment testing or motion base testing 

or TV system testing or whatever the subsystem might be. In this section, we 
* * 

present a limited amount of information on several topics that apply to all of 
the simulator equipment tests or to substantial numbers of them. 

« 

The topics discussed in this section are test timing, test signal generation 
and test data acquisition. ' • - - - 


7.2.1 Test Timing Techniques 

t The alternative techniques for obtaining time reference information that 
f/ere considered included the following: 

i 9 -Internal computer clocks 

• Interrupt generation by simulator central timing’ unit 

• Programable external clock 

these alternative techniques were explored in terms of how they would affect the 
implementation of the test software, what the impact of test changes might be on 
the test software, and v/hat would be the accuracy and reliability of the time 
information associated with the data obtained. 


The use of internal computer clocks seems a low accuracy and low reliability 
approach for several reasons. First, the feasibility and the approach for its 
implementation are very highly sensitive to the particular make and model of 
computer system that is controlling the test. Secondly, in the simulator 
configurations considered for the study there is always assumed to be an inters 
facing digital computer, probably a minicomputer, between the host computer and 
any simulator equipment. If the test is controlled from the host then there is > 
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a substantial time delay between the time at which the host commands an- output or 
Receives a data word and the time at which that information- v/as active in the 
simulator hardware. In addition, unless only one device is addressed at a time, 
this time lag is likely to be variable depending on the amount or quantity of 
information that was communicated in the data transfers. Consequently, the 
disassociation of the- time reference in the computer and the time of events 
happening at the simulator equipment v/as considered .an -.undesirable and.. , , 
unpredictable situation that is best avoided. 4 


The central timing equipment for the simulators will generage interrupts 

* l- 

at various time intervals to control and synchronize various intercomputer data 
transfers and to maintain a common real time reference during the actual simulation. 
One approach to timing test operations is to have all test events triggered by an 
interrupt generated by this equipment. This results in a test software load that 
is in some v/ays similar to the simulation software load and presents'a familiar 
programming problem to the simulator programming support personnel. Unfortunately, 
interrupt processing does not provide a time reference in the absolute sense. The 
^time must be calculated in the computer by updating a time counter. Concurrently, 

- che interrupt can trigger the sampling of the analog signal's by the DCE. This has 
the potential of providing a good time reference for data acquisition. However, 
if the computer commands a stimulus, the time at which the stimulus arrives at 
the equipment being tested is known accurately only to an accuracy of one interrupt 
interval. Interrupt processing is of course vulnerable to the peculiarities of 
each computers interrupt processing logic. .... 


Implementation of a programmable digital clock external to the computing 
equipment is an inexpensive and simple alternative. A programmable clock can be 
implemented by using a high frequency pulse rate from the central timing unit to 
drive a counter which can be assembled from commercially available logic circuit - 
elements. The interrupt pulses used to drive the counter can be of much higher 
frequency than would probably be used for interrupt processing as described in 
the previous paragraph and the clock would therefore have inherently better 
resolution. The programming requirement is only to have the ability to reset to 
zero on command. The clock output can be tied permanently to a register in the 
DCE and that register can be addressed and read every time that test data is 
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sampled from the analog or discrete channels. The programmable reset feature 
enables the clock to be reset every time a transient response test is initiated. 
Kjis makes the clock time an absolute time reference from, the- time of the test 
Signal input. The reset feature is unnecessary for frequency response testing 
because an absolute time reference is not needed. The clock will cycle through 
its own reset point when it reaches the limit of its count which will require 
some software logic to adjust accordingly. > 

The external digital ’ clock is simple, inexpensive and insensitive -to the 
type of computer system incorporated .in the simulator. It can also be .used as 
a time reference for' checking the elapsed time of digital processes independent 
of the computer clock. This affords further- opportunities for simulator timing 
checks. 


7.2.2 Test Signal Generation 

The classic stimulus/response approach for testing a component or subsystem 
assembly requires the application of external inputs to the unit under test, 
and the subsequent monitoring, measuring, and analysis of the outputs elicited. 
This section discusses various techniques for generation, distribution, and 
j^ppli cation of test stimuli. 


/ 

- There are five basic ..types of-test stimuli used in the process->of hardware, 
verification and checkout. These are analog. DC signals, repetitive continuous 
signals, transient test signals, special purpose digital patterns, and noise 
signals. Each of these signals may be generated by either software or hardware 
techniques. Software techniques, in the context of a simulator configuration, 
refers to generation of the signals in the host or ancillary computers and routing 
to the simulator equipment through the DCE if the final signal is analog. In €he 
following discussion we address the requirements for all five types of signals and • 
the alternative means for generating them. 


7. 2. 2.1 Analog DC Signals 

The analog DC signals are non-repetitive but may be time varying at a very 
low rate. Analog DC signals are used to test discrete channels to such devices 
as indicators or flags, as well as meters and servo systems including the motion . 


• - 
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base servos. Analog signals can be used to check the data conversion equipment 
^i^ nne ^ s for linearity as well as for calibration. 

Analog DC signals could be generated by special purpose 'or already available 
hardware, for example., by switching signals from a programmable calibrated power- 
supply. However, in the context of the simulator configuration, commanding analog 
outputs on the DCE' channel s in the same manner as regul ar outputs on those, 
channels 'is most ■economi'Cally dnd expeditiously accomplished by the test software, 

7. 2. 2. 2 Repetitive Continuous Signals 

Repetitive signals of interest include sine v/aves, square waves, sawtooth 
waves and other wave forms that are commonly generated by test hardware signal 
generators for test purposes. There are two sets of test signals in this 
category that are of particular interest for purposes of simulator self test. 

These are the low frequency sine wave signals required-for frequency response testing 
. of the servo systems in the visual simulation and for the motion base, and the 
complex high frequency wave forms required for video system self test. 

Low frequency sine waves and other basic wave shapes can be generated by 
"■"software and transmitted to the simulator hardware through the regular DCE 
channels. Although the converted signal will be stepwise discontinuous, -the . 
maximum conversion rate of the D/A converters is so high, about lOKHz, that it 
will not be detected by the low frequency systems to be. tested. The natural 
frequencies of the servo systems should be no more than several hundred Hertz 
even for the pitch and yaw servos in the probe. The irregularity of the D/A 
converted signal will not be preceptible to these devices. 

The 'high frequency wave forms required for the TV system tests are so high 
in frequency, 20 MHz, that there is no need to consider software techniques for 
this purpose. Instead, it is necessary to incorporate a standard television 
test pattern generator into the test equipment. Switching may be required for 
turning on power or selecting’ the desired test patterns but this can be 
accomplished with commercially available solid state switches. . ■ 
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7. 2. 2. 3 Transient Test Signals 

The primary signal of interest for transient response testing is the step 
function. Fortunately, this. signal can be generated accurately by transmitting 
the required step magnitude through the appropriate D/A channel. The low 
natural frequency of the simulator systems being tested insures that the signal 
that arrives will be sensed as an instantaneous step. This is also an aspect 
enhanced by processing through the D/A hardware. On one cyple the signal 
communicated will be the zero : level. On the next, cycle,, the signal is the step 
amplitude. The settling time of the D/A is approximately the rise time of the 
step and should be about 100 microseconds. 

7. 2. 2. 4 Digital Patterns 

Digital patterns required for testing of digital interfaces, or addressing 
and conversion hardware in the DCE, can be generated either by hardware or 
software. In the simulator environment, the use of the digital computer to 
generate these patterns for testing everything (except maybe itself) seems like- the 
logical choice. However, if a system interface hardware develops a troublesome 
history, it may be desirable to introduce a hardware pattern generator. There are 
available programmable digital pattern generators that can be programmed to issue 
T to 1024 bits of data either in a serial stream or in parallel groups of words 
of up to 16 bits each. 

7. 2. 2. 5 Noise Signals 

White noise signals have an equal amount of energy in every unit of the 
frequency bands within the range of interest. White noise signals are used in 
either a continuous or impulsive mode in order to verify the response of a 
component or subsystem to different frequencies of input signals. 

i 

The use of noise signals for frequency response testing permits concurrent 
verification of response to various frequencies with application of a single 
stimulus. In order- to obtain the same response information with individual 
frequency inputs, many single frequency stimuli would be required, with the 
number depending on the range of interest. 
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The principal disadvantages of the white noise signal are that it distributes 
pjj'e signal energy over all frequencies in the bandwidth which .adversely effects 
the signal to noise ratio that might otherwisebe achieved if only discrete 
frequencies were of interest. Since a relatively limited number of frequencies 
are likely to be considered for subsequent processing, this factor may be 
significant when practical -applications are considered. The filtering. .of ’ 

unnecessary high frequency signals is a requirement for limiting- the- noise in^ 
the test process. 

White noise with a bandwidth of several hundred cycles, which is all that 
is required for potential simulator subsystems tests, can be readily generated 
by software techniques and communicated to the systems being tested through the 
available DCE. 


7.2.3 Test Data Acquisition Techniques 

As previously noted, test data acquisition is a primary topic of the analyses 
of each of the simulator subsystems and components addressed in this study. In 
J;his section a few general and broad aspects of test data acquisition are 
“onsidered inasmuch as these factors are applicable to all of the study hardware 
self test activity. 

The three areas which seem appropriate to address are 'sensors, switching, 
and data storage. 

7. 2. 3.1 Sensors 

Early in the study it became apparent that sensing of the response of 
simulator subsystems to commands from the computer was going to be a primary 
problem area. Consequently, sensor technology was given a considerable amount 
of attention. Assembly of generic sensor data could easily reach encyclopedic 
proportions and is best left to other, sources such as the industry directories 
for sensing equipment and transducers. 


The basic reason that sensing is a problem area is that simulator self test 
requires observing and recording parameters that are intended to be observed and 
recorded manually if necessary by a crew member. In addition we are concerned 
^with devices that were designed to be manipulated by the crew member which also 
^created a problem of automatic manipulation in a calibrated manner. 
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The manipulation of controls can be addressed largely by servomechanisms and. 
Glenoids but sensors are available in many more varieties. Sensors- considered 
for the present study included the following generic types: 

9 Mechanically activated 
e. Magnetically activated 

• Light activated 

• ‘Thermally activated 

• Current activated 

e Pressure activated (fluidic devices) 

® Acoustically activated 

A more detailed discussion of sensors of interest may be found in Section 

8 . 3 . 1 . 2 . 


7. 2. 3. 2 Switching Techniques 

The switching requirements for implementing self test techniques for the 
various simulator subsystems are substantial. Particular attention was payed to 
fchis area' in the development of the data conversion equipment self test techniques, 
switches considered included cross bar switches, reed relays, magnetic switches*, 
and solid state (MOS/FET) switches. The latter seemed the most suitable for 
reliability, cost and failsafe characteristics. Switching concepts are discussed 
further in Section 8.2.3. 


7.2.3. 3 Data Storage (Temporary) 

There was no evaluation made of any means of .storing large volumes of data 

for either a long term or short term (minutes) basis. The nature of the tests . 

anticipated is such that the temporary storage capacity of the computer memories 
. « 

available is not strained. Incipient fault detection data is assumed to be. 
stored in a data base system with media undefined. The accessabil ity of the 
incipient fault detection data. to the computer on a daily basis is a prerequisite 
for implementation of the analyses as planned. However, the data base require- 
ments are not expected to be so great that this should present any major problem 
with respect to the availability of resources for data storage. 
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^3 TEST DATA PROCESSING ' 

^ In Section, 7.1 we addressed the various types of tests that were of interest ‘to 
this study and then considered the techniques that were found during the course of 
survey activities for accomplishing the objectives of those tests. It was 
established that fault detection for the low frequency dynamic systems could be 
accomplished with transient response testing. Incipient fault detection was also ■ . 
addressed by the same techniques. However, fault- isolation for these systems re-- 
quired analysis of the frequency response data. In addition, it is anticipated 
that check out of' the aural simulation system Will be based on a harmonic analysis 
of the various sounds being simulated. Both of these objectives require the 
definition of frequency response data for the systems involved. 


‘ In this section we address the problem of obtaining the frequency responses of 
a system from test data. If the frequency response test is performed by stimulating 
the tested system with one frequency at a time, then there is no data processing 
required to arrive at the frequency response. However, if the frequencies of 
interest are mixed (summed) to reduce the time required for implementing the test,, 
ftr if actual run time data is logged at opportune moments to obviate the need for 
operating the system solely for test purposes, then more sophisticated processing- 
techniques are required merely to arrive at the, frequency response data required^ 
for subsequent fault isolation analysis. In addition, definition of the spectral 
signature of the aural simulation will require .decomposition of complex sounds into 
their spectral components in order to assess the correct simulation of the source 
sound signature. 


Consequently, in this section we consider the application of the Fourier 
Transform, its implementation with the Fast Fourier Transform algorithm, the error 
sources that must be considered in sampling data for Fourier analysis, and finally 
the techniques for deriving the frequency response of a system from normal operating 
time histories logged at an appropriate timejn a simulator training exercise, 

t 

7.3.1 Frequency Response from Sampled Dynamic Test Data (Fourier Transform 
Techniques) 

The traditional method of generating frequency response or a Bode plot 
is serial. The system is forced with a pure sinusoid at a certain frequency 
|^ntil reaching a steady-state oscillation, at which time the gain and phase 
are recorded. The process is repeated for as many frequency points as desired. 

In certain instances, it may be more convenient to generate a frequency response 
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using a broad-band test signal, containing components over the entire frequency 
^ange of interest. This could be either a sum-of-sinusoids signal. Reference 7.3-1 
®r a "white" pseudo-random noise signal, References 7.3-2 and 7.3-3. For a linear 
system (or a non-Vinear system driven in its nearly-linear range), tha response 
to each frequency component of the composite signal will be the same as its 
response to that signal supplied in pure form; therefore, the complete frequency 
response can be developed by a frequency analysis of the system's response to 
the composite signal. 


This frequency analysis, or decomposition of the composite response into 
its harmonic components, can be accomplished by use of discrete filters or a 
single sweep filter, but today is more commonly implemented in sofrware, by 
use of the Fast Fourier Transform (FFT), described in the following subsections. 


7. 3. 1.1 Fourier Transform Definitions 

The basic Fourier transforms for a time function f(t) are given by 


F Cic-0 - 

fffl = J 
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provided that the integrals exist. If the function f(t) is non-periodic, then 

its transform (spectrum) will be continuous. If the function is .periodic 
with period T, then integration need only be performed over a single period of 
the function, and its spectrum will consist of discrete points (a "line spectrum"). 
In practice, there is some difficulty in obtaining a sample record whose length 
is precisely equal to one or more complete periods of the time function; this 
problem is discussed in the next subsection.' 


For digital processing, the time function must be sampled. The transformation 
is then implemented by the Discrete Fourier Transform (DFT), in which the integrals 
are replaced by sums. The computation time required for straightforward 

O 

evaluation of the DFT (proportional to N , where N is the number of samples) tended 
to inhibit its application until the development of the Fast Fourier Transform (FFT) 
The FFT algorithm takes advantage of certain symmetries in the trigonometric 
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functions, making the computational load proportional to N logN instead of 
pen the number of samples is a power of two, t'he computational savings are 
larticularly significant; e.jg., a factor of 200 for N=1024. (A thorough 
derivation of the FFT algorithm, as well as FORTRAN listings, is provided in 
Reference 7.3-4 or Reference 7.3-5.) 


€ 


The Fast Fouri'er Transform subroutines are applied by setting up data 
arrays in the next higher level program, that is, the one that calls the .FFT 
subroutine. These arrays include the sampled data time history, as well as 
arrays for storage of the results of the Fourier transform analysis. When 
the subroutine is called it computes the FFT and stores the amp! itude' and phase 
angle relationships for each frequency derived from the sample. The correlation 
of the frequency data with real time frequencies must be accomplished by the 
calling program which only needs the real time sample rate at which the samples 
were taken to do this. 


7. 3. 1.2 Sampled Data Error Sources and Their Correction 

Certain error sources are introduced into sampled data analyses because 
le sampled data is only an approximation to the continuous signal from which 
it was derived or because the duration of the sample must be limited rather than 


infinite. In addition, there is the problem of noise commonly found in, the. real 
world, that has a tendency to upset analytical expectations. Consequently, for 
the frequency response analyses described in the previous subsection, we need to 
be concerned with several error sources. These are noise, aliasing and leakage. 


Noise 

Over long time spans, random noise will contribute spurious components to 
the output spectrum, mildly distorting its the shape. For short data records, 
however, significant sampling error in the frequency components of the noise 
will badly distort the spectrum in an erratic manner. Thus it is important 
to remove as much of the noise as possible before FFT processing. 


The basic method of removing noise is by low-pass filtering of the continuous 
waveform, before sampling and digitizing. The breakpoint on this filter must 
of course be established as a compromise between allowing noise to pass, and 
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attenuating the higher frequencies present in the signal (see also the 
discussion of aliasing*- below). If pre-filtering of the signal is not feasible, 

’^j^'me smoothing can be achieved after the sampling and digitizing, by first 
differentiating and then integrating the digital data. (Since this operation 
will destroy the amplitude reference, it is necessary to save the" first amplitude 
data point before differentiating, and then use this point as an initial condition 
in integrating.) ■ , • > 

I 

For repetitive data which are synchronously triggerable (e.g., TV waveforms 
referenced to a line-sync pulse), averaging is a powerful technique for noise 
attenuation. The randomness of the noise implies that noise samples in different 
records will cancel, making the underlying signal easier to detect and analyze, as 
shown in Figure 7.3-1. Assuming perfect synchronization of consecutive data 

records (i.e., negligible time jitter), the theoretical improvement in signal-noise 
ratio is J”TT, where M is the number of data records averaged together. For 
example, a signal derived from the average of 100 data records will show a 
factor-of-ten improvement in signal/noise ratio. 

t 

^Mj£sj_ncj_ 

In sampling data, it is essential to sample the incoming data at a sampling 
frequency at least twice the highest frequency present in the data. Power present 
at high frequencies will not be filtered out by the sampling process. It will be 
"folded over," and appear as spurious power at lower frequencies. This phenomenon, 
known as "aliasing," is explained by Figure 7.3-1. This figure shows two pure 
sine waves, differing in frequency by a multiple of 1/T, which cannot be distinguished 
from each other by samples at a spacing T. For example, if a signal is sampled 20 
times per second, the apparent power at 9 Hz will actually include all power present 
at 11, 29, 31, 49, ... Hz. Aliasing cannot be compensated for after the data has 
been sampled. It must therefore be prevented, either by sampling at an adequate 
rate, or by pre-filtering the continuous data to remove high-frequency components 
which are not of interest in the analysis (e.g., random noise). 

Lea kage 

In the real world, we always work with finite-length records. If this time- 
domain truncation can be performed in a manner such that the data record consists 
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(a) t Typical raw-data record 


(b) Average of 1000 records 


FIGURE 7.3-1 USE OF AVERAGING TO IMPROVE SIGNAL-TO-NOISE RATIO 



FIGURE 7.3-2 ILLUSTRATION OF "ALIASING": THE HIGH-FREOUENCY SINUSOID 

LOOKS LIKE ITS LOW FREQUENCY ALIAS WHEN SAMPLED AT TOO LOW A RATE 
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of a precise integral multiple of the base period of the function, the- accuracy 
^f the transform is unaffected by truncation. Truncation to any other time-span 
'"'results in "leakage" of somJ signal power from its correct location into "side- 
lobes" of the line spectrum. This degradation of accuracy (line "smearing") is 
depicted in Figure 7.3-3. 

.Leakage is reduced and spectral lines are sharpened by a technique called 
"windowing," whereby the digital data is multiplied by a window function which 
tapers to zero toward both ends of the data record, before transformation. This 
• makes the time function look more nearly' periodic in the window; typical results 
are shown in Figure 7.3-4. Further discussion of the* appl i cations and techniques 
of windowing may be found in Reference 7-8. 


7.3.2 Frequency Response From Logged Operational Data 

The application of the Fast Fourier Transform as discussed in the previous 
section produces the frequency' response of a system under test when the input or 
stimulus signal is a known quantity such as a sum of sinusoids or white noise 
signal. If the amplitude and phase characteristics of a signal that occurs 
puring normal operation of the system could be established, it would appear that 
the response of the system to this random signal could be computed as" before and 
then consequently the frequency response. The advantages are several. First, 
there is no requirement for dedicated system test time. Secondly, there is no 
need to generate special test signals. Finally, there is no wear and tear incurred 
on the system just for the purpose of testing. For a simulator subsystem such 
as the motion base, the latter is an important factor. 

Unfortunately, although the Fourier transform can be applied to both input 
and output signals, there is no timewise correlation involved between the two 
and hence no phase information available unless something further is done. During 
the survey activity, three different approaches were found which are described 
briefly below. These approaches are susceptible to the quality of the signals 
that are normally available from the systems being analyzed. In additioji, becase 
the mathematical operations required are rather complex, it is not determinable 
without some development effort how well conditioned the basic mathematical 
approaches are. Inherent mathematical instabilities may preclude the successful 
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(a) Time-domain Samples 



FREQUENCY 


(b) ‘Resulting Fourier transform 


FIGURE 7.3-3 LEAKAGE EXAMPLE: FOURIER TRANSFORM OF A COSINE WAVEFORM; 

TRUNCATION INTERVAL' NOT EQUAL TO A MULTIPLE OF THE PERIOD 
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(b) "Windowed" time function 



FIGURE 7.3-4 USE OF "WINDOWING" TO REDUCE LEAKAGE 
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application of these techniques. These techniques are neverthel ess described 
^gelow because they represent a technology which has definite potential in the 
Pfimulator area and should be considered for future development effort. 


These techniques are referred to as the- running left-side Laplace Transform 
technique, the noise injection technique and the correlation processing technique. 


7.3.2. 1 Running Left-Side Laplace Technique .... 

The running left-side Laplace transform technique. Reference 5-9, is appli- 
cable to monitoring of single-input, single-output 1 i near - system, satisfying a 
differential equation of the form, 


X -r 


P, * + P z * 


~ S Q u + z, u. + • 


•*2 


a 


in 

The overall operation of the process, as shown in Figure 5. 3.-5, is as follows: 


. m 


e Raw input and output data are transformed to generate 'a set of algebraic 
coefficients for input to a simultaneous -equation solver; 

* The equations are solved to generate estimates of the constants in the 
differential equation representing the subsystem operation; 
e Finally, the estimated constants are compared to nominal values, drawn 
from the data base, resulting in a good/bad assessment of the subsystem, 
operation. 


The coefficients for the simultaneous equations can be formed by a variety 
of methods, e.g. repeated differentiation, repeated integration. The method -Garzia 
favors is the use of a "running left-side Laplace transform," (RLLT), a 
generalization of the well-known Laplace transform, defined as: 

- F (s t l) - / -f (Tv) 

The properties of this transform are similar to. those of the basic Laplace 
transform, with modifications as required by the finite limits of integration. 

The desired equations are formed by forming a set of RLLT's for distinct values 
of s, chosen to span the frequency ranges appropriate to the input and output. 
Conveniently, these RLLT's can be formed by hardware low-pass filters (or equivalent 
software difference equations), making it possible to generate the requisite (m+n) 
simultaneous equations simultaneously, in parallel, with relatively little 
computational load. 
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basic Functional Path 



FIGURE 7.3-5 GARZIA'S RUNNING LEFTSIDE LAPLACE TRANSFORM PROCEDURE 


Basic Functional Path 



FIGURE 7.3-6 FLOW OF NOISE INJECTION ANALYSIS 
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' FIGURE 7.3-7 CORRELATION PROCESSING TO OBTAIN FREQUENCY RESPOND 
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The difficulty, of course, comes in the process of solving this set. Not 

f ly does the computational load increase rapidly with system complexity 
roportional to the cube of the number of equations), but there is always a 
strong probability of ill-conditioning. Ill-conditioning would in turn lead to 
inaccurate answers even under ideal conditions; the presence of measurement noise 
or nonlinearities could make the results completely meaningless. 

The advantages of this technique are the following: 

• It can track system transfer functions continuously in real time. 

• No special test signals are required. 


7. 3. 2. 2 Noise Injection Techniques 

Injection of a signal outside the operational frequency band of a system 
(e.g., spikes, pseudo-random noise), followed by extraction of the system's 
response signature, is a method tried some years ago for implementation of 
adaptive autopilots. Overall flow of this method is shown in Figure 7i3-T 
after Garzi a Reference 7.3-6. High-frequency pseudo-random noise, generated 
by digital means, is passed through an A/D converter and added to the basic 
J^iput u(t) at a summing junction; the composite signal is input to -the subsystem 
under test. The output x(t) will then be the subsystem's response to the 
total applied signal. If the subsystem is linear (superposition is valid), the 
•output of the A/D converter/filter will consist of the subsystem's response to 
•the noise signal alone. Cross-correlation of the noise input and the filtered 
output (a rather involved calculation) will then yield the high-frequency 
portion of the subsystem's transfer function. Low- frequency response cannot 
be detected by this technique. 

7. 3. 2. 3 Correlation Processing 

As an alternative to providing special test signals, system frequency 
response can be estimated by processing of actual operational input and output 
•data. The computing load will of course be higher, and the accuracy of the 
estimated system characteristics will be lower; however, some testing time will 
' be saved. 
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Figure 7.3-7 shows the computational flow for a determination of the, 

J input/output gain and phase components of a subsystem transfer function G(s) 

.from monitored operational data. Denoting. the input as f-j('t) and the output 
as f 0 (t), first compute <P_ the autocorrelation of the input, and the 
input/output cross-correlation, using 

■ ■ ft* = is- £ W i < r-0 Jt •. - ■ 

The FFT of the input autocorrelation is the input power-spectral-density. 

The cross-correl ation , which provides phase information directly, is also trans- 
formed by the FFT into the input/output cross-power-spectraT-density. # . 

These two spectral densities then provide an estimate of the gain component of the 
subsystem frequency response, by 
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SECTION 8 

’ DEFINITION OF HARDWARE AND SOFTWARE TECHNIQUES FOR SIMULATOR CHECKOUT . 

This section presents the results of Subtask 1.3 which addressed the defini- 
tion of hardware and software techniques for implementing self test for the. 
various simulator subsystems specifically in terms of their anticipated confi- ■ ' 
guration and scope for future NASA training simulators. The subsystems 
addressed indivicually consist of the ancillary digital - computers and their 
interfaces. Section 8.1; the data conversion equipment. Section 8.2; the controls 
and displays for the crew stations and the instructor operator stations, Section 8.3; 
the visual simulation .subsystems , Section 8.‘4; the motion base equipment, ; 

Section 8.5; and miscellaneous equipment consisting of the aural cue system, the 
power supplies and the external clocks in Section 8.6. 

The ancillary digital computers of primary concern in section 8.1 are the 
flight computers and the flight computer interface devices that are anticipated 
for this equipment. The testing proposed for this equipment consists primarily 
j^f functional testing to insure proper operation as part of a readiness check. 

The isolation of faults for this equipment should be'addressed by maintainance- .. 

software provided by the vendors since 'the effort required. for development of,, 

such software for one specific application is exhorbitant. 

Self test of the data conversion equipment is discussed in Section 8.2. 

The self test of the data conversion equipment has been addressed in ’the past 
at the Johnson Space Center and the status of the current capability in this 
area is reported in Section 6. The primary requirement for self test of this 
equipment is test software and automatic switching for implementing loop 
closures for both end to end readiness testing as well as for fault isolation 
tests. 

The self test techniques applicable to the controls and displays in the 
crew stations and the instructor operator stations are discussed in Section 8.3. 

The requirements for implementing controls tests are distinctly different from 
the requirements for displays. Consequently, overviews of the displays testing 
^problem may be found in Section 8.3.1 arid of the controls problem in Section 8.3.8. 
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'Self test techniques, for the visual simulation subsystems are discussed in 
^ection 8.4. The equipment- in the visual simulation subsystem has .been divided 
into three groups' each of which have relatively unique or distinctive test re- 
quirements. These three groups consist of the image transmission system, the 
display equipment and the scene generation equipment. The image transmission 
equipment analysis addresses the test techniques applicable to the TV system*-' . 
electronics and the TV camera electro-optical .interface.; The motion -problems 
associated vrith the camera drive system and the probe are deferred to the scene 
generation equipment tests. Section 8.4.3. Section 8.4.2 addresses self test 
techniques for the display equipment which presents unique problems because of 
the marginal optical /observer interface. 

The self test techniques applicable to the motion base equipment are pre- 
sented in Section 8.5. Self test techniques for various several miscellaneous 
items are presented in Section 8.6. • 

The integration of the testing for the equipment addressed in Section 8 
-i c cuh.-ject of Section 9. 
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.1 ANCILLARY COMPUTERS AND INTERFACE EQUIPMENT • • 

The variety and complexity of simulator equipment that exchanges digital data 
with the host computer (HOST) place a- heavy demand on input/output processing. 

This demand is satisfied' in the Shuttle Training Simulators, as defined in the 
Reference Configuration of Section 5, by minicomputers that perform the data 
formatting and time buffering- required to handle simulator data; The most demanding 
interface in terms of type and rate of data transferred is the HOST to Flight Compute 
(FC) link. A special purpose Flight Hardv/are Interface Device (FHID) will be 
required to handle this input/output link. This FHID has both processing and 
storage capabilities peculiar to the HOST/FC interface characteristics. 


The FHID verification problem is analyzed first and an approach developed in 
Section 8.1.1. The FC is then analyzed at a higher level than the FHID. Section 
8.1.2 covers this analysis not so much with the objective of developing checkout 
techniques for each LRU in the FC, but rather to identify the various diagnostics 
that the manufacturer is likely to develop and to establish a checkout approach 
that makes maximum use of these diagnostics. Section 8.1.3 covers the analysis 
|jpf minicomputers, their interfaces with the HOST, and the various techniques 
already documented in 8.1.1 and 8.1.2- that may be applicable to verification of this 
equipment. 

8.1.1 Flight Hardv/are Interface Device 

The Reference Simulator Configuration includes three flight computers. The 
FC's are used to achieve a high degree of fidelity both in the type of processing" 
performed as well as the amount of time used to carry out this processing. In the 
actual Orbiter, the FC's interface with elements of various Shuttle systems. In 
the Simulator these elements or their functions are simulated by the HOST and it 
is this variety and complexity of functions that place a heavy demand in rate and 
data handling versatility at the interface between the HOST and the FC's. Figure 
8.1-1 is a block diagram that illustrates the FHID interfaces. 


There are some elements of the Avionics System, such as guidance elements, that 
generate data at such a rate as to possibly overload the HOST/FC link. If a 
controllable hardv/are generator of these data is used external to the HOST, then 
^this potential saturation of. the link can be prevented. 
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The FHID provides all the interface services to permit direct comnuni cation 
fctween the HOST and the FC-'s. This device includes enough hardware modeling, 
buffering, and control to allow the flight program to run in real time. Hardware 
modeling in the FHID is particularly used to generate rate variable data and 
present time variable data to the FC. This modeling function contributes greatly 
to decreasing the* amount .of data transfers involving both the HOST and FC 
concurrently. 

Interface between the FC and the Display Electronics Unit is' provided within 
the FHID. This configuration permits the HOST to monitor and, if necessary, to 
alter the data flowing between the Flight Computer and the Keyboard and Display 
Units (KDU) at the crew station. 


8. 1.1.1 FHID Description 

The major functional components of the FHID are the HOST Interface, the ' ' 
various processors, a central buffer storage, the DEU interface, mass memory 
interface, a simulated Avionics Master Timing Unit, and the FC (IOP) and FC (AGE) 
■interfaces. Figure 8.1-2 is a block diagram of the FHID illustrating the general 
information flow between each of these functional elements, and Table 8.1-1 
lists the line replaceable units as defined for the FHID. Characteristic para- 
meters for each of these LRU's are listed in Table 8.1-2. The following text 
further -describes the function and interrelation of the FHID elements. 

HOST .Interface 

This unit provides the necessary functions to permit orderly interchange 
of data between the HOST and the FHID. These functions are described below. It 
must be remembered that many actual quantitative details, such as number of bits 
per transfer, are dependent on the manufacturer -and model number of the computer 
selected as HOST for the given simulator. 


Logic Level Conversion - This function is performed by the drivers and receivers 
¥ 

used to convert the computer cable signal levels to internal FHID logic levels 
which, for consistency, are defined as being equal to those in the DCE that is: 
True, or Logic 1 +4.0 + 1.5 vdc 

False, or Logic 0 +0.4 + 0.4 vdc 


8-5 


MCDOfVfVEI-L nOOCL/SS ASTFtOFilAUTtCSt COMP^/l/y. EAST 



MCDONNELL. DOUGLAS ASTRONAUTICS CO/V7P/1WK- EAST 


CO 

I 

cn 




FIGURE 8.1-2 FHID INTERNAL INTERFACES 


MDC Ell 50 
1 November 1974 









8-7 


TABLE 8,1-1 . LIST OF rTTd LINE REPLACEABLE UNITS 


LINE REPLACEABLE UNIT 

FUNCTION 

INTERFACES WITH 

Host Interface 
(HI) 

Data formatting, sequencing, and synchronizing 
for transfers between HOST and FHID. 

HOST, P's, CBS, DEUI, 
MMI, SAMTU, FC/II, FC./AI 

Processors 

(P's) 

Data processing for interdevice communications. 
Computations for time and rate variable data. 
Fault simulation Tor FHID and FC self-test. 

HI, other P's, CBS, 
DEUI, MMI, SAMTU, 
•FC/II, FC/AI 

Central Buffer Storage 
(CBS) 

Temporary storage for flight program parameters. 
Temporary storage for block transfers between 
HOST, PC's, DEU, and FHID processors. 

HI, 'P's, DEUI, MMI 
FC/II, FC/AI 

DEU Interface 
(DEUI) 

Data formatting, sequencing, and synchronizing 
for transfers between DEU and FHID. 

HI, P's, CBS, MMI 
FC/II, DEU 

Mass Memory Interface 
(MMI) 

Data formatting, sequencing, and synchronizing 
for transfers ' between MM and FHID. 

HI, P's, CBS, DEUI, 
FC/II, FC/AI, MM 

Simulated Avionics 
Master Timing Unit 
(SAMTU) 

Generate GMT and MET as indicated by HOST 
commands. Issue time data to devices requesting 
this information. 

HI, P's, FC/II 

FC (IOP) Interface 
(FC/II) 

Data formatting, sequencing, and synchronizing 

for transfer of operational data between FC IOP -• 

and FHID. 

HI, P's, CBS, DEUI, 
"-'MMI , SAMTU, FC/IOP 

FC (AGE) Interface 
(FC/AI) 

Data formatting, sequencing, and synchronizing ' 
for transfer of flight program data between FC 
and FHID. Provide means for FC program execution 
control . 

X 

HI, P's, CBS, MMI, 
FC/AGE 

k 
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LINE REPLACEABLE UNIT 

FUNCTION 

INTERFACES WITH 

Host Interface 
(HI) 

Data formatting, sequencing, and synchronizing 
for transfers between HOST and FHID. 

HOST, P's, CBS, DEUI, 
MMI, SAMTU, FC/II, FC/AI 

Processors 

(P's) 

Data processing for interdevice communications. 
Computations for time and rate variable data. 
Fault simulation for FHID and FC self-test. 

HI, other P's, CBS, 
DEUI, MMI, SAMTU, 
FC/II, FC/AI 

Central Buffer Storage 
(CBS) 

Temporary storage for flight program parameters. 
Temporary storage for block transfers between 
HOST, FCs, DEU, and FHID processors. 

HI, -P's, DEUI, MMI . 
FC/II, FC/AI 

DEU Interface 
(DEUI) 

Data formatting, sequencing, and synchronizing 
for transfers between DEU and FHID. 

• HI, P's, CBS, MMI 
FC/II, DEU 

Mass Memory Interface 
(MMI) 

■ i , 

Data formatting, sequencing, and synchronizing 
for transfers between MM and FHID. 

HI, P's, CBS, DEUI, 
FC/II, FC/AI, MM 

Simulated Avionics 
Master Timing Unit 

(samtu) ; 

Generate GMT and MET as indicated by HOST 
commands. Issue time data to devices requesting 
this information. 

HI, P's, FC/II 

FC (IOP) Interface 
(FC/II) 

Data formatting, sequencing, and synchronizing 
for transfer of operational data between FC IOP 
and FHID. 

HI, P's, CBS, DEUI, 
MMI, SAMTU, FC/IOP 

FC (AGE) Interface 
(FC/AI) 

Data formatting, sequencing, and synchronizing 
for transfer of flight program data between FC 
and FHID. Provide means for FC program execution 
control . 

HI, P's, CBS, MMI, 
FC/AGE 

n 
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B fr?ta Formatting - The data- transferred to and from -the- HOST are grouped in 8, 16, 
\32, 64 or any other number of bits depending on manufacturer and model number of 
the HOST. The internal word length of the FHID has been defined for purposes 
of this study as 16 bits. The formatting "function comprises the .packing and 
unpacking of FHID words into groups compatible •with the HOST -interface.. For 
example, if this interface uses 64 bit transfers',' each of these transfers is 
divided into, or assembled from, 4 different FHID words. 

Timing. - This, function covers synchronization and time buffering of data transfers 

in order to overcome variations in time dependent differences between the HOST and 
FHID hardware. It also includes time tagging of certain data. 

r 

Sequencing Control - Data transfers involve the generation of and response to 
control signals used to achieve device selection and identification, and to 
determine when and how much data may be transferred. 

- Data Routing and Acquisition - The HOST Interface Section routes data from the 
P^QST to the proper processor in the FHID to Central Buffer Storage, to the FC 
or EDU interface, or 'to any of the other sections of the FHID. 

Processors 

There are several (the precise number to be determined during actual design) 
processors in the FHID to perform computations for rate and time variable data 
generation, as well as for processing, monitoring, and controlling other data 
routed through the FHID. These processors have their own memory, index and 
process control registers, data bus and I/O channel. 

Each processor may accept from or issue data to other processors, the HOST, 
the FC, or other devices within the pHlD - 

Central Buffer Storage 

* 

This is a' large random access memory that stores simulation parameter data 
either permanently or during block transfers- between digital elements of the 
simulator connected to the FHID. -The capacity of this buffer will be determined 
^during actual design but is currently estimated at no more than 40,960 eighteen 
bit words. 
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ay Electronics Unit Interface ' ’ " ‘ • : ■ ’ . 

This section of the FHID provides the interface circuitry for data transfers' 
between the FHID and the DEU. Data from the crew station digital command keyboard 
goes to the DEU and is routed to the HOST, and in some cases to the FC, through 
the FHID. Also, data intended for the GRT displays'- o'n the crew- station, whether'' 

generated by the FC or HOST are routed- through this- section of the -FHID/ * : 

■ • - 4 , - 


The DEU interface performs the data formatting and routing functions for 
transfers involving the DEU, HOST, FC FHID processors, FHID CBS, and pther devices 
within the FHID as these data -pertain to the crew station keyboard or display unit. 


Mass Memory Interface 

The inclusion of this interface assumes that a simulated or actual mass 
memory — magnetic tape, disk, other — would be a part of the simulator. The 
mass memory contains flight program data such as used for mission phase related 
overlays, and the onboard display formats. The mass memory function in the 
^simulator could also be performed by the HOST computer complex, in which case 
■phis interface would not be necessary. 


The mass memory interface section of the FHID handles -data transfers between 
the mass memory and the FC, the HOST, or the DEU. Within the FHID, this section 
communicates with processors for data formatting and possible alteration under 
HOST control, with the FC/I0P interface, with the FC/AGE interface to simulate 
ground loads, and with the DEU for display information transfer. 


Simulated Avionics Master Timing Unit 

Because of the functionally central location of the FHID in the digital 
data processing network of the simulator, the SAMTU is included in this device. 

The flight MTU provides, .on request only, status information, Greenwich Mean Time, 
and Mission Elapsed Time. The FHIDwill perform this function in the simulator. 

The SAMTU receives initializing time loads from the HOST, and responds to 
time data requests from the HOST, the FC, or any of the FHID processors involved . 
with processing rate or time variable parameters for the simulation. 
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TABLE 8.1-2 CHARACTERISTIC PARAMETERS OF FHID LRU'S 

LRU INPUTS 

OUTPUTS 

PERFORMANCE 

HOST 

Interface 

-Data from HOST (1) 
-Address (1) 
-Interface Controls (1) 
-FHID Data (2) 
-FHID Device Status (3) 
-FHID Device Ready , (3) 

-Data to HOST (1) 
-Address (1) 
-Interface Controls (1) 
-Data to FHID devices (2) 
-FHID Device Select (3) 

rThruput 90,000 words/sec 
-Peak Thruput 

9,000 words in 40 msec 

Processors 

-Data from FHID Devices (2) 

-Interface Controls (3) 

-Interrupts (3) 

4 Priority Levels 
16 Sublevels 

-Device Address (4) 

-Device Status (4) 

-Data to FHID Devices (2) 
-Interface Controls (3) 
-Processor Address , (4) 
-Processor Status (4) 

-No. of Instructions 40 
-Memory words (2) 4096 

-Memory Cycle Time 500 nsec. _ 

-Accumulators 4 
-Index Registers' 8 
-Interval Timers (T6-bit) 2 

Central 

Buffer 

Storage 

-Data from FHID Devices (2) 
-Interface Controls (3) 
-Storage Address (2) 

-Stored Data (2) 
-Interface Controls (3) 
-Status Data (3) 

-Capacity -in Words 40,960 
-Cycle Time 500 nsec 


(1) Characteristics depend on HOST Computer Selection 

(2) 16-bit words + 2 bits parity . Logic Levels 

(3) Logic Levels (See 8. 1.1.1) 

(4) Number of lines and function depend on detailed FHID design 
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TABLE 8.1-2 CHARACTEfUfrc PARAMETERS (CONTINUED) 


LRU 

INPUTS 

OUTPUTS 

PERFORMANCE 

DEU 

Interface 

-Data from DEU (5) 
-Interface Controls (5) 
-Data from FHID Devices (2) 

-Data to DEU (5) 
^-Interface Controls (5) 
-Data to FHID Devices (2) 


Mass 

Memory 

Interface 

-Data from MM (6) 
-Interface Controls (6) 
-Data from FHID Devices (2) 

-Data to MM (6) 
-Interface Controls (6) 
-Data to FHID Devices (2) 


Simul ated 
AMTU 

-Data from HI (2) 
-Interface Controls (3) 
-Time Data Request . (3) 

-Time Data (2) 
-Status Data (3) 
-Interface Controls (3) 

-GMT Resolution .125 msec 
-Met Resolution .125 msec 

FC/IOP 

Interface 

-Data from FC (7) 
-Interface Controls (3) 
-Status Data (3) 
-Sync OK (3) 

-Data to FC (7) 
-Interface Controls (3) 
-Status Data (3) 
-Sync OK (3) 

-Number of Parallel Channels 31 
-Data Rate 1 M bit/sec 

FC/AGE 

-Data from FC (8) 

-Status Data (3) 

-Data from FHID Devices (2) 

-Data to FC • (8) 
-Address to FC 18-bits (3) 
-Interface Controls (3) 
-Data to FHID Devices (2) 
-FC Execution Controls (3) 



(5) Logic Levels. Format compatible with DEU design (6) Dependent on detailed MM design 
(7) 28-bit serial word, includes 3-bit sync, 1 parity bit, 24-bit data 
* (8) 36-bit parallel word, includes two 16-bit half-words with 2 bits each for parity and memory protect 


k/fii aaamaAOM 
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Flight Computer (Input Output Processor) Interface • 

All operational- Avionics -data to and from the FC during flight activity 
simulation is routed througfl the IOP. The IOP is directly connected to the FHID 
FC/IOP section where FC output data -is routed to the HOST, the DEU interface, and 
various FHID processors. Control and request commands' from FC are routed to the 
Mass Memory, the SAMTU; the HOST and FHID processors where other onboard systems . 
are being simulated. • ; 

The FC receives through the FC/IOP section, of the FHID flight and control 
data from the HOST, the DEU (crew keyboard inputs). Mass Memory, SAMTU, and 
various FHID processors. 

Data transfers take place with format, sequence, and timing characteristics 
that faithfully reproduce the flight subsystems and permit the FC programs to 
execute in real time as they would during an actual Shuttle mission. 

Flight Computer (AGE) Interface 

During checkout and prelaunch activities, the FC is connected to the AGE 
by a special connector- that permits access to internal functions of the computer , 
and provides a means for ground controlled program loads. The FHID FC/AGE 
interface provides the means for data transfers between the HOST or the Mass 
Memory and the FC memory. In addition to these data links, control of program 
execution can be exercised at this interface. Control functions include; Reset 
Start, Stop, Single Step Advance, Compare Stop, Register Read, and Register Load. 

8. 1.1. 2 FHID Failure Mode Analyses 

The FHID components are digital in nature. Failures of these components 
manifest themselves in one of three different modes: (1) a constant logic 1 output, 
unable to switch to a logic 0; (2) a constant logic 0 output, unable to switch to 
a logic 1; and (3) an output which may or may not represent the inputs and there- 
fore is intermittently erroneous. • 

A -failure may occur in data storage or gating circuitry, in which case 
^erroneous data would affect the accuracy of flight data calculations, and therefore 
the fidelity and overall performance of the simulator. The Subsystem affected is 
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^determined by the type of data involved and the area. of the FHID hardware where 
the fault occurs. On the other hand, a failure may develop in address generation 
or recognition circuitry. This type of error causes data or commands to be routed 
to improper devices, or not to be transferred at all. The first case, may not be 
immediately recognized, but instead may be processed having the same effect on 
the system as that caused by' presenting wrong data to the right 'device. I-n the 
latter case, the I/O control circuitry may either lock up or, if so designed, 
time out after a predetermined period and reset the interface control circuitry 
after generating a time out error indication to the ; processor involved in the 
I/O operation. 

Table 8.1-3 lists the various failure modes for each of the LRU's and the 
possible sources of these failures. Automatic self-test of the FHID should test 
overall performance capability of the device, and then test for the presence of 
any one of the problems listed in this table. Not included are overall failures 
caused by problems in the power circuits, or. the logic synchronizing clock oscil- 
lator, divider, and gating circuitry. These type of failures are catastrophic 
^enough to prevent self-testing, and are usually obvious enough not to need automatic 
checkout. . ‘ 

8. 1.1. 3 FHID Test Techniques 

The FHID is a piece of equipment that would be procured independent of other 
elements of the simulator not only because of its relatively large physical and 
cost magnitude, but also because it would necessarily be a special purpose device 
designed to match the interface characteristics of the various devices it inter- 
connects. This fact of separate procurement implies that provisions for self- 
test of the FHID would be a part of FHID design and, to a large extent, independent 
of the self-test facilities of other elements of the simulator. 

In many respects, and specifically in testing philosophy, the FHID can be 
treated as a computer. The FHID is a complex device whose function depends pri- 
marily on solid state, electronic, digital components. It has data processing 
and computations capability and is able to store data as input, as well as the 
computed or reformatted results to be output to any of various other elements 
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TABLE 8.1-3 FAILURE MODES OF FHID LRU'S 


LRU 

FAILURE 

POSSIBLE SOURCE OF FAILURE 

•HOST 

INTERFACE 

1. Unable to communicate with HOST 

1. a. Line drivers or receivers 

b. Interface control logic 

c. Address decode or generation circuits 

d. Status generation or recognition circuitry 


2. Unable to communicate with FHID 
device 

2. a. FHID device interface control logic 

b. FHID device address circuitry 

c. Interface logic within FHID device 

d. Status generation or recognition circuitry 


3. Errors in data transferred 

3. a. Line drivers or receivers 

b. Interface buffer registers 

c. Data gating circuitry 

d. Faulty cableing, internal or external to FHID' 

PROCESSORS 

1. Unable to accept or issue data 

1. a. Processor I/O channel circuitry 

b. Processor stopped . 

c. Program error 


2. Errors in data outputs . 

2. a. Processor I/O channel circuitry 
b. Arithmetic/Logic Unit 


. . 

c. Accumulator, Index, or other registers 
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TABLE 8.1-3 ' FAILURE MODES OF FHID LRU's (Continued) 


LRU 

FAILURE 

POSSIBLE SOURCE OF FAILURE 

CENTRAL 

BUFFER 

1. Unable to communicate with FHID 
device 

1. a. FHID device interface control logic 
b. FHID device address circuitry 

STORAGE 

2. Errors in data read out 

c. Interface logic within device 

d. Status generation or recognition circuitry 
2. a. Memory Data interface register 

b. Data gating circuitry 

c. Memory elements in CBS • 

d. Memory address selection logic 

DISPLAY 

ELECTRONICS 

UNIT 

INTERFACE 

1. Unable to communicate with DEU 

1. a. Line drivers or receivers * 

b. Interface control logic 

c. Address decode or generation circuitry 

d. Status generation or recognition circuitry 

i ♦ 

2. Unable to communicate with FHID 
device 

3. Errors in data transferred 

2. a. FHID device interface control logic 

b. FHID device address circuitry 

c. Interface' logic within device 

d. Status generation or recognition circuitry 

3. a. Line drivers, or receivers 

b. Interface buffer registers 

c. Data gating circuitry 

d. Faulty cabl'eing 
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TABLE 8.1-3 FAILURE MODES „0F FHID LRU'S (Continued) 


LRU 

FAILURE 

POSSIBLE SOURCE OF FAILURE 

MASS 
MEMORY 
‘ INTERFACE 

1. Unable to communicate with Mass 
Memory 

1. a. Line drivers or receivers 

b. Interface control logic 

c. Address decode or generation circuitry . 

d. Status generation or recognition circuitry 


2. Unable to communicate with FHID 
device 

2. a. FHID device interface control logic 

b. FHID device .address circuitry 

c. Interface logic within device 

d. Status generation or recognition circuitry- 


3. Errors in data transferred 

3. a. Line drivers-or receivers 

b. Interface buffer registers 

c. Data gating circuitry _ 

d. Faulty cableing 

SIMULATED 

• 1. Unable to accept time load from 

1. a. Interface control- logic . 

AVIONICS 

HOST or respond to time requests 

b. Address generation for decode circuitry 

MASTER 

v - , 

f 

c. Time data gating logic. 

TIMING 

UNIT 

2. Errors in time data output 

2. a. Time computation processor 

b. Time counter advance circuits 

c. Data gating circuitry 

d. Address generation or decode circuitry 

i* . * , ► 
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TABLE 8.1-3 FAILURE MODES OF FHID LRU'S (Continued) 


LRU 


FLIGHT 

COMPUTER 

IOP 

INTERFACE 


FAILURE 


POSSIBLE SOURCE OF FAILURE 


1. Unable to communicate with FC 


2. Errors in data transferred 


3. Unable to communicate with FHID 
device 


1. a. Line drivers or receivers 

b. Interface control logic 

c. FC address generation circuitry 

d. Address decode circuitry in FHID 

e. Status generation or recognition circuitry 

f. Faulty cableing 

2. a. Line drivers or receivers 

b. Interface buffer registers, 

c. Data gating circuitry 

d. Faulty cableing 

3. a. FHID device interface control logic 

b. FHID device address circuitry 

c. Interface logic within device 

d. Status generation or recognition circuitry 


1. Unable to transfer data or exercise 

1. a. Line drivers or receivers 

control of FC 

b. Data gating or synchronizing circuitry 


c. Faulty cableing 


d. Interface control circuitry 


e. Address generation or decode circuitry 

2. Errors in data transferred 

2. a. Line drivers or receivers 


b. Interface buffer registers 


c. Data gating circuitry 


d. Faulty cableing ■ , 


FLIGHT 

COMPUTER 

AGE 

INTERFACE 
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TABLE 8.1-3 FAILURE MODES OF FHID LRU'S (Continued) 


LRU 

FAILURE 

POSSIBLE SOURCE OF FAILURE 

FLIGHT 

COMPUTER 

AGE 

INTERFACE 

(cont'd.) 

3. Unable to communicate with FHID 
device 

3. a. FHID device interface control logic 

b. FHID device address circuitry 

c. Interface logic within device 

d. Status generation or recognition circuitry j 
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pf the system. And finally, like a computer, the FHID is delivered and maintained 
-"with special purpose programmed diagnostic routines. The use' of these "existing" 
routines, and dependence on "existing" built in test (BIT) hardware, is the basis 
for developing a self test approach to the hardware verification of the’FHTD. 

This section concentrates on identifying the magnitude and functional capability- 
of both the test hardware -.and the test software that should be made a par.t of 
the FHID procurement, design, and delivery. 

BIT Hardware 

No special BIT hardware is required to be added to the FHID mainly because 
there would normally be enough lines and circuits in the basic design to permit 
• access to components. This access is usually provided through the manual test 
panel included in computers or large pieces of digital equipment such as the FHID. 

For purposes of this study emphasis is placed on automatic self-test performed 
on a daily basis in an integrated system manner. Manual operations at the test 
panel would requirea high level of training in test personnel and extend the 
period of testing from seconds to minutes and even hours. Hov/ever, if the 
connections available to the- test panel are made accessible to the processor 
performing the automatic self-test, it will be possible to' quite thoroughly check 
out the FHID in minimal time, even to the point of accomplishing a detailed level 
of fault isolation. • ’ 

The only hardware, then, that can be considered BIT hardware is the relatively 

* 

small amount of gating and cableing required to give the HOST access to test panel 
functions. The study is based on the assumption that no other BIT hardware, is 
included in the FHID -design. 

Self-Test Software ‘ 

The Self-Test operations of major concern to the study are those performed 
on a periodic basis after the simulator has become operational in order to verify 
the functional readiness of the system. It is, therefore, safe to assume that the 
HOST computer is connected to the FHID and ready to conduct checkout of the 
interface device. The overall self-test philosophy for the FHID is based on this 
[assumption, thereby relegating primary .control of FHID self-test to the HOST 
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•computer. The software required for FHID self-test can be divided in two distinct 
groups: 

1. Self-Test Software resident in HOST 

2. Self-Test Software resident in FHID processors 

fhe first group includes programs to supervise and control overall execution' of’ 
the self-test. Also included are the LRU peculiar test sequences and pattern 
generators to verify FHID internal and external interfaces, as well as FHID device 
functional integrity. Figure 8.1-3 illustrates the overall structure and inter- 
:omponent relationship of the HOST executed test software. 

The second group covers the processor executed diagnostic software which, 
jnder HOST command and control, is used to verify the computational, storage, and 
interfacing performance of the processors. There are two sets of programs in this 
group related to two different hierarchical levels of test. One set includes the 
computational and interactive routines used to verify the link between the HOST 
and the processors, as well as the general functional readiness of the processors 
during FHID overall test. The other set includes the processor peculiar diag- 
nostics used to verify every register, storage location, interrupt function, and 
instruction execution performance of the processor. Figure 8.1-4. shows, the structure 
and components of the processor resident test software. 

The primary functions of each of the self test software elements are described 
below. The actual sequence of test execution, and flow diagram of the test software 
follows the software element description. 

FHID Test Supervisor - Supervisory functions for FHID self test are contained in thi 
software element which is executed by the HOST computer. These functions are: 
Interrupt handling 
I/O Processing 

System parameter data base access 
- Data time tagging and verification 

Test software loading and overlay control 

Overall FHID Test - This program controls the sequence of test execution from the 
the host computer verifies results, and performs fault isolation to the LRU level. 
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The tests are performed in the following sequence: 

Interface Test 
- FHID Processor Test 
CBS Test 
SAWTU Test 

After these tests are performed, the operational readings of the FHID can be 
ascertained with a high level of confidence— greater than 98%. If a higher 
level of confidence is desired, or fault isolation beyond the defined LRU'S 
is to be performed, then the Test Panel functions can be exercised by the HOST 
with the Component Level Test. 

Interface Tests - These tests verify the ability to establish and carry out digital 
communications between digital devices in a prompt and accurate matter. Interfaces 
between FHID and external units such as the HOST and FC are checked, as well as 
interfaces between internal FHID devices. Generally, these tests consist of the 
^following steps: 

■ Issue an I/O commmand that requires data to be transferred across the interface 
in question. 

2. Transfer a data word consisting of an all one’s pattern. 

3. Verify accuracy of transfer. 

4. Transfer data in an all zero's pattern. 

5. Verify accuracy of transfer. 

6. Check for parity error indication 


The length of the data word and method for verifying accuracy of transfer are 
dependent on which interface is being tested. The interfaces to be checked for 


the FHID self test are: 

- fh i d/host 
FHID/HM 

- FHID/DEU 

- FHID/FC-(I0P) 

- FHID/FC-(AGE) 

- HI/P's 
N - P's/CBS 

- P's/SAMTU 
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Processor -Tests - Each of the FHID processors can be thoroughly tested using ' 
processor diagnostic- routines- 'loaded from the HOST. The Processor Test software 
executed -in the HOST consists of the subroutines required to perform. this loading, 
and then to initiate, monitor-, and control execution of processor diagnostics. 

This software also include test result evaluation and error reporting routines used 
by the HOST to establish processor integrity and determine test progress and success. 
In addition- to- Processor Test control software, executed by the HOST, there is a bloc! 
of FHID of processor machine language program data. These data contain the self test 
diagnostics executed by the processor itself and consist of three main tests. The 
ALU Test can be performed with little intervention by the HOST. However, the memory 
and register test require the HOST to' monitor test points brought out from' the pro- 
cessor to verify correct loading and clearing of each memory device. 

ALU (Arithmetic Logic Unit) Test - Verifies execution of all instructions in the 
processor repertoire. It performs .the following: 

- Exercise all instructions using all available addressing formats (direct, indirec 
relative, etc.) 

- Force occurrence of individual and simultaneous interrupts by commanding interrupt 
generation registers in the FHID verify handling according ’to pre-established priori t. 

Output results to host computer. 

I 

2. Memory Test - Verifies integrity of processor dedicated storage, by means of the 
following steps: 

Load all storage locations with all ones and read back using direct memory access 

- Verify the load 

Load all storage locations with all zeros and verify that the locations have been 
cleared 

* Simulate interrupts and verify performance of operations peculiar to specific 
storage locations 
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3. Register Test - Checks register operation by the following steps: 

Load all ones in each register and verify 

Load all zeros in each register and verify 

Load each register with a unique pattern and verify 

Central Buffer Storage Test - Every storage location of the CBS is checked by 
this test. The steps involved are: 

Load all memory locations of the CBS with all ones. The load may be performed 
from the HOST or by using a HOST commanded digital pattern generator in the FHID 

- Real all CBS locations from the HOST and verify an all ones load 

Load all memory locations of the CBS with all zeros. This load may also be 

performed by test hardware in the' FHID, under HOST command 

- Read all CBS locations from the HOST and verify that all locations have been 
cleared 

■ SAMTU Test - The Simulated Avionics Timing unit in the FHID can be tested simply by 
^verifying that an initial time load can be performed, and. then checking the accuracy 
of the time advance .calculations,. The two tests. Time Load and Count Accuracy, can 
be accomplished with the following steps: . ‘ * 

Issue a Time Load command to the GMT timer 

- Load a maximum GMT time (all ones) 

Read GMT and verify all ones 

- Issue a start GMT Advance command 

Wait x.x seconds (to be determined by resolution and accuracy requirements) 

- Read GMT and verify proper time count ( seconds plus I/o processing time) 

Repeat the above steps for MET timer 

Component Level Tests - The availability of FHID test panel functions to the HOST 
permit fairly detailed automatic trouble shooting to be conducted. Through these 
test connections, the HOST can load and read any one of the registers, accumulators, 
buffers, or memory locations in the FHID circuitry. It is possible, also, to verify 
step by step signal or data processing within the FHID by giving the HOST control 
of the clock pulse generation circuitry in the FHID. This level of checkout and * 
^fault isolation, however, is beyond the defined LRU level and actual step by step 
implementation of the tests is dependent on the detailed characteristics of -the 
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design, and the degree to which automatic troubleshooting is desired. Component 
level testing is mentioned here only to point out the possibility of including 
this capability in the initial design of the FHID and its associated Self Test 
system. 

FHID Processor Test Controller - This software element is the supervisor, monitor, 
or sequencer that controls other software which, like the controller, is executed 
by the FHID processors. The Test Controller handles I/O operations, interrupt 
requests, and sequences overall processor software execution during testing' 
operations. As previously stated, there are two types of tests that require FHID 
processor execution of test software: 1) those tests controlled by the HOST to 
establish overall readiness of the processor, and 2) those tests controlled by the . 
processor to verify correct operation of the processor ALU, memory, and registers. 

The HOST controlled tests' require the processor to respond to individual queries fror 
the HOST. These queries may involve: 

- Execution of I/O operations to check overall performance of the processor I/O 
channel . 

- Processing of logic and mathematical operations to verify overal-1 performance 
of the ALU 

- Execution of memory readout and data relocation subroutines to verify operationa' 
capabilities of FHID processor memory and registers 

The processor controlled tests, although initiated and sequenced by HOST commands, 
are mainly executed by the processor and encompass the type of diagnostic self test 
operations generally performed by a stand alone, full-fledged computer. For the FHI1 
processor, these diagnostics include: 

- An Instruction Execution, or ALU Test 
A Register Test 

A Memory Test 

A FHID Device Interface Test 

The Device Interface Test is of particular importance to FHID checkout. This test 
verifies the processor's ability to communicate with other FHID devices, such as 
! the CBS or DEUI , using the hardware and software resources available to the processo 
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during normal operations. ^The FHID device interface tests are performed following 
the same basic sequence of steps outlined above, under HOST Controlled Interface 
Tests. 

8. 1.1. 4 FHID Test Sequencing 

Several of the references used in this study base their test sequence development 
on the "bootstrap”, "building block," or "start small" philosophy. This is an 
approach to diagnostic testing which seeks sol id ’hardware failures by first 
establishing that a portion of the hardware is operating properly, and then using 
that hardware to check additional hardware whose condition is unkown. Inherent 
here is the concept that each new area is relatively small and that those areas 
previously tested form the foundation needed to check the new area. 

The exact order and scope of each building block should be depend on the best 
use of the hardware in the building block in performing the next test. 

*1 n selecting the first area to be checked, the concept of a "hardcore" is taken 
into consideration. Hardcore, as related to automatic self test, is that part of a 
system that must be checked manually prior to automatic analysis of other sections. 
This concept is relevant in FHID testing only in so far as it is required to verify 
that proper power is being applied to the hardware, and that the proper test soft- 
ware has been loaded in the HOST. Testing then can proceed in the following sequence 

1. Verify HOST/FHID interface 

2. Verify HI/CBS interface 

3. Verify CBS 

4. Verify Hi/Processor I interface 

5. Load FHID Processor I with Processor Self Test Software 

6. Verify Processor I memory- 

7. Test Processor I instruction execution 

8. Test Processor I register operation not already verified by 5, 6, and 7 above. 
This includes interrup processing hardware Test. 

9. Repeat for Processor 2 through N. t 

10. Load SAMTU related software on FHID processor assigned to Master Timing Unit 
^computati ons . 
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• 11. Verify interface between each FHID Processor and the FHID devices .assigned 
to be serviced by that Processor. 

12. Verify FHID/MM interface 

13. Verify FHID/DEU interface 

14. Verify FHID/FC-AGE interface 

15. Verify FHID/FC-IOP interface 

At this point overall operational readiness of the FHID can be established. If a 
failure has occured, further detailed testing can be performed using the component 
Level Tests possible by accessing the FHID Test Panel or control console func ons. ' 

It is also possible to accelerate testing and verify parall processing capabilities 

of the FHID processors by loading doagnostic tests in each processor. Execution of 
these tests laid. out in Figure 8.1-5, can then be initiated simultaneously in all 
processors, and the results communicated to the HOST. 
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FIGURE 8.1-5 FLIGHT HARDWARE INTERFACE TEST FLOW (FITST) 
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FIGURE 8.1-5 FLIGHT HARDWARE INTERFACE TEST FLOW (FITST) (Continued) 
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FIGURE 
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FLIGHT HARDWARE INTERFACE TEST FLOW (FITST) (Continued) 
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8.1.2 Flight Computer 

E "The Flight .Computers (FC's)- provide the fo 1-1 owing data processing capability 
f n the orbiter: computation for guidance, navigation and control, payload 

manipulator subsystem control , payload management, and system performance moni- 
toring for orbiter and orbiter dependent payloads. There are five- Flight Computers 
in the operational Orbiter. Shuttle simulators have three or five, depending on 
simulator configuration. ' j 

-The machine selected by NASA for the FC job is an IBM AP-101 computer, of 
the 4 Pi family. The FC verification techniques survey that follows depends 
entirely on the use of vendor supplied diagnostic routines, .as currently documented. 


8. 1.2.1 Flight Computer Description 

The FC consists of two major processing elements: The Central Processor Unit 

and the Input/Output Processor. Both processors have access to a common memory. 
Figure 8.1-6 shows the principal functional elements of the FC and their opera- 
tional interrelation. 


The AP-101 machine includes several features that make it a unique and 
‘advanced performance flight computer. Expanded storage capacity, microprogramed' 
control, and a sophisticated multiplex input/output architecture are key features 
in the FC that give it a high level of performance. Of special interest to this . 
study, is the inclusion of Built In Test Equipment (BITE) in the original design 
of the FC. ‘ - - ' • * • 


Standard memory capacity is 65,536 32-bit words, expandable in 8,192-word 
modules up to 131,072 words. The microprograming of control increases the 
instruction execution efficiency of the computer, and facilitates adaptability and 
response of the machine performance to changes in vehicle or mission design. 


Input/Output operations are performed by a processor capable of conducting 
31 operations concurrently using 31 different data buses. Each data bus operates 
at one megahertz and can service up to 31 separate subsystems. Control of data bus 
transfers is maintained by a Bus Control Element (BCE). The I0P permits cross 
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coupling BCE's in pairs in order to allow data transfers directly from one sub- 
system to another without going through CPU hardware, or IOP local memory. I/O 
(J^-ates vary depending on the mode of transfer from 250,000 to 333,333 full words 
per second. 

The built-in test capability includes sufficient built-in test equipment (BITE) 
to provide rapid (on line) and off-line self detection of malfunctions. This hard- 
ware, together with self test software and the use of micro-diagnostics provide 
the FC with an extensive capability for verifying the operational status of the 
machine. 

8. 1.2. 2 FC Built In Test Equipment 

There are two sets of BITE hardware in the FC: one set in the IOP, and 

another in the CPU. The IOP BITE includes the following: 

1. A watchdog timer. (Times out if not reloaded by program v/T thin time 
loaded — 768 microsec to 3.1 seconds) 

2. Redundancy Management voter logic 

3. Parity check on IOP microinstructions 

4. Parity check on memory to IOP bus 

5. Timer/clock oscillator stop detector 

6. Power loss for longer than 400 microseconds 

7. Programmable device response timer 

If any of the above hardware detect a malfunction, the FC is notified by means of 
an external interrupt. 

The CPU BITE monitor activity between the CPU and memory and between CPU and 
IOP. This equipment includes the following: 

1. CPU/IOP response timer (about 8 microseconds) 

2. Parity check on CPU microinstructions 

3. Parity check on CPU/IOP bus 

4. Parity check on CPU/memory bus 

5. Store protect key compare logic 
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Detection of a malfunction, by the first four result in a machine check interrupt, 
fftt attempt to access protected storage by a program with the wrong key results 
•in generation of a program check interrupt. 


All of the above BITE is on line actively checking for malfunction during 
normal operation of. the FC. Self test capability includes the, means to verify 
that all BITE hardware is operational to a .99 probability. , 

\ 

8. 1.2, 3 FC Self Test Description ' * 

The AP-101 self test hardware and software ascertain the operational readiness 
of all computer functions to a .96 level of confidence. Self test software include 
the means to checkout both the CPU and IOP functions. 


The CPU test program checks execution of the FC instruction set. Instructions 
are exercised using all registers and verifying the direct, indirect, relative 
and other memory addressing formats. Machine check errors are forced in order to 
test the fault detection capabilities of the BITE. Program interrupts are also 
paused, and response of the computer to these interrupts is checked. CPU tests 
Wake use of special mi crodi agnostics that permit quick testing of the hardware and 
firmware by exercising normal paths of data transfer, and also test’ paths that by- 
pass BITE when it "is desired to force an error, as in the case of generating 
erroneous parity to verify parity detection circuitry. Some of these mi crodi ag- 

* r 

nostics can be called for on line testing during normal FC operations. 


The memory test program verifies the ability to store and read exhaustive 
test data patterns in all operationally accessible core locations of main storage. 
This test also verifies interrupt handling and related operations peculiar to 

fn 

specific core locations. ' ' 3j> 


The IOP test program verifies' correct performance of IOP elements in executing 
IOP microinstructions. IOP self tests also check local buffer storage' operation 
and verify bit accuracy and timing characteristics of the Master Sequence Controller 
and the Bus Control Element. 
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^8. 1.2. 4 FC Self Test Operations 

Daily Self test of the FC during operational period of the' -training simulator 
can be initiated and controlled from the HOST. The HOST can either load all self 
test software through the FHID, either from the HOST memory or from the Mass 
Memory. The total self test program to be loaded on the FC has been estimated .by 
IBM to be 1.500 words in length. . 

The HOST, through the FHID and the FC AGE interface, monitors the progress 
of the self test and detects the generation of fault indications as forced during 
execution of the various tests. Successful or unsuccessful completion of self 
test can be communicated to the HOST by the FC, or the HOST can detect the outcome 
by monitoring the various test indications available at the GSE connections of 
the FC. 

8.1.3 Other Minicomputers • 

' The Simulator Reference Configuration of Section 5 includes auxiliary mini- 
computers to process I/O transfers between the HOST and other elements, of the 
j^imulator. Minicomputers perform the formatting, data buffering, and time related 
Adjustments in transfers to and from the Data Conversion Equipment, and also to 
and from the Motion Base monitor and control hardware.. 

These minicomputers are expected to be relatively general purpose, off-the- 
shelf machines supplied to NASA with support and self test software. The actual 
capability of this software, the types of tests run, and the level of confidence 
achieved by these tests vary from model to model. In either case, the testing 
approach discussed above for the Interface Device and its processors and- also for 
the Flight Computers can be applied to auxiliary interface minicomputers. 

The basic self test approach for ancillary computers and flight equipment 
interface hardware can be summarized as follows: 

1. Self test of this equipment should be based on manufacturer supplied 
self test software and built-in test equipment. 

2. Evaluate' adequacy of manufacturer's self test software and hardware. 
Specify additional capability if required: 
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a. Determine method of loading self test diagnostic programs on machine to 
be tested. If possible, it is better to use operational loading path . 
instead of loading through the HOST. This method’ of loading verifies 
some of the operational interfaces and reduce the amount of " processing * ' 
required of the HOST. 

4. Design self test system to be controlled by the HOST in order to maximize 
utility of common test control, test pattern generation, and pattern 
compare routines. Another advantage of maintaining control at the HOST 
is to provide one central place where the operator can initialize total 
system or individual subsystem testing and monitor the results of each 
of the tests run. 
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DATA CONVERSION EQUIPMENT . ... ' . . 

This section discusses techniques for self test of the data conversion 
equipment; The primary requirement for DCE self test. is to establish operational 
readiness of the equipment using automatic techniques. The secondary requirement 
on the selected approach, for -self test is the ability to detect faults and iden- 
tify the faulty LRU using- automatic means for fault isolation. The- most effective 
method for automatic test is to output data to the output devices, monitor- these 
outputs with the input devices, and perform comparisons and fault isolation using 
the resultant data.^ This section, will concentrate on techniques and methods for 
acquiring this data, detecting faults and isolating to an LRU. 


8.2.1 Data Conversion Equipment Description and Characteristic Parameters 

The Data Conversion Equipment is that part of the simulator which interfaces 
the computer with Crew Station and I0S display and control elements, as well as. 
the Motion Base components and the Visual Simulation System. The DCE provides 
digital/analog/digital conversion as well as data formatting, synchronizing, 
storage and drive where required for the subsystems mentioned above. Figure 8.2-1 
^|ws the major portions of the DCE involved in this signal conversion and distri- 
bution task. 

8. 2. 1.1 Input/Ou'tput Control and Address 

The input/output control logic performs the control signal sequencing required 
to perform an orderly transmission of digital data between the minicomputer and 
the rest of the DCE. It is this logic that generates I/O interrupts to initiate, 
alter, or terminate I/O operations. Signals from this section of the logic start 
and advance both the input and the output address counters. 


The output address counter is reset to channel zero and an upward count 
started by the I/O control- logic with the receipt- of a WRITE command at the 
beginning of a block transfer output. The counter is advanced to the next channel 
each time a word is received. The word received is routed to a specific digital- 
to-analog converter (DAC) or to the group of discrete drivers as indicated by the 
value of the address counter. The block labeled "digital output routing and 
address decoder" contains the logic hardware that determines which output channel 
Up to receive fhe data transmitted' from the minicomputer. 
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Data from the simulator components are also read in by the minicomputer 
jblock form. A READ command resets the input address counter and starts a 
int which is advanced by the transfer .of each word. Both discrete and analog 
formation is transmitted in and out of the minicomputer in each block transfer. 

1.1.2 Analog Signal Paths " , 

There are 200 analog, output channels, each of them with its corresponding • 

Only one ADC is used to digitize analog data from the 100 input channels. 

: channel at a time is connected to the ADC by means of multiplexing solid 
,te switches.. 

* 9 

Buffer amplifiers are used between the input lines from the simulator 
ipment and the multiplexing switches in order to provide a low impedance 
rce to the ADC, while presenting a high impedance to the analog sensors. 

: input impedance varies from 500 to 10,000 ohms depending on the specific 
ign. Most of the analog sensors have impedances greater than 500 ohms and, 
ding substantially affects the accuracy of the reading obtained. 

The open impedance (Rso) of the multiplexing switches may be as low as 
megohms. Figure 8.2-2 shows the equivalent circuit for a group of 'these 
tches feeding into the ADC.' The source, or buffer amplifier output impedance 
) must be much less than the input impedance of the' ADC i.n order to assure 
s than 1 % loading or error in the signal fed to the ADC. 



L 

FIGURE 8.2-2 EQUIVALENT CIRCUIT WITH A BUFFER AMPLIFIER PER INPUT 
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>.1.3 Discrete Signal Paths 

i ' 

The 16 bits in a minicomputer input/output word can contain status/command 

; ormation for a group of 16 discrete channels. Output commands are routed, 

iording to address decode logic, to 16 bit registers which serve as the memory 

:tion for the various discrete signal drivers. These drivers provide a ground 

open signal to bilevel- devices in the simulator such as indicator lights or 

jctrical valve actuators. There are 2500 of these drivers in the reference 

ifiguration. 

Input discrete information is contained in the 2000 lines from simulator, 
lponents to the DCE. These lines are strobed onto the minicomputer 1/0 bus, 
groups of 16, during an input block transfer. The group routed to the bus 
determined by the digital input multiplex logic. 

I. 1.4 Line Replaceable Unit Characteristic Parameters 

"This section summarizes the characteristic parameters of the components 
1 group of components, within the DCE, which will be treated as line replace- 
ie units. It is to this level that checkout and fault isolation analysis will 
carried out for automatic checkout considerations. 

Table 8.2-1 lists the characteristic parameters for each of the DCE LRU's, 
jse are the parameters of concern in the self test process, in that they are 
isured to determine the operational status and readiness of the corresponding 

J. The paragraphs that follow further discuss each LRU as to its function and 
metrical configuration. These discussions list characteristic parameters and 

ler numerical and qualitative data that will be helpful in defining the Simulator 
If Test System. 
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TABLE 8. 

2-1 DCE LRU CHARACTERISTIC 

PARAMETERS 


CHARACTERISTIC 

* 

LRU 

PARAMETER ‘ 

DIMENSIONS 

CONTROLLER 

Data 

16 Bits at LL* 

Device Address 

16 Bits at LL* 


Interface Controls 

12 Lines at LL* ’ 

iESS COUNTER 

Channel Address 

10 Bits at LL* 

[TAL OUTPUT ROUTING 

Data 

16 Bits at LL* 

ID ADDRESS DECODER 

Analog Channel Select 

200 Lines at LL* 


Discrete Group Select 

156 Lines at LL* * . 

[TAL TO ANALOG 

Analog Output Voltage 

-10 to +10 Vdc 

INVERTER 

Output Current 

Up to 10 ma 


Accuracy 

0.05 to 0.025% of full scale 
+1/2 value of Least 



Significant Bit 

• 

Settling Time 

10 usee to 0.1% full scale 

IRETE SIGNAL DRIVER 

ON-Output Impedance 

Less than 5 ohms 


OFF-Output Impedance 

• Greater than. 5 Megohms 

10G TO DIGITAL 

Data 

15 Bits at LL* 

DNVERTER 

Accuracy 

0.02 to 0.025% full scale 


Resolution 

1 part in 32,768 . . 


Conversion Time 

100 usee 

FER AMPLIFIER ' 

Analog Output 

-10 to ’+10 Vdc 


Accuracy 

■ 0-1% full scale 


Settling Time 

10 usee to 0.1% final value 

LOG CHANNEL 

Output Signal 

-10 to +10 Vdc 

LECT SWITCHES 

Switching Time 

2 usee 

ITAL INPUT MULTIPLEXER 

Data 

16 Bits at LL* 

ND ADDRESS DECODER 

Discrete Group Select 

125 Lines at LL* 


Analog Channel Select 

100 Lines at LL* 


Start Conversion Command 

1 Line at LL* 

LL is Logic Levels which 

are defined as: True: +4. 

0+1.5 Vdc 


False.: +0. 

4 + 0.4 Vdc 
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Input/Output Controller • ' ■ 

The input/output controller provides the signal conditioning and control 
between the minicomputer and the DCE. The characteristic parameters associated 

with signal conditioning are easily defined in physically quantitative terms; 

however, the control and sequencing operational characteristics require timing 
diagram descriptions which, are usually peculiar to- the minicomputer being used. 
This analysis will limit itself to the following parameters: 

Interface signals are at logic levels which are: - 
True +4.0+^ 1 .5 Vdc 

False +0.4 + 0.4 Vdc 

Data Format: 16 Bits parallel 
Reliability: 50,000 hours MTBF 

Address Counters ■ . 

These are two counters - one for input, and one for output. Counting is 
done in binary form starting at zero and incrementing the count by one each 
time a word is transmitted. The counter specifies the address of the data 
v/ord to be transmitted. The following are the pertinent characteristics: 

All signals are at logic levels: 

Inputs: Control timing. 

Advance count command 
Outputs: 10 bit binary address 
Reliability: 500,000 hours MTBF 

Quantity: 2 

, ■ 

Digital Output Routing and Address Decoder 

This unit receives a binary address from the address counter, decodes the 
address and, upon command from the 1/0 Controller, transfers data words to the 
addressed DAC or group of discrete drivers. The following are the pertinent 
characteristics : 
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All signals are at logic levels 
Inputs: 16-bit data word 

10-bit address 

Transfer output word command 
Control timing 
Outputs: 16-bit data words 
Storage select 

Reliability: 50,000 hours MTBF 

Digital to Analog Converter 

The digital-to-analog converters receive digital v/ords and convert these 
to analog signals. The DAC receives a digital word as parallel bits accompanied 
by a strobe signal. This data is strobed into a digital storage register in 
the DAC. The digital output of the register activates analog current paths pro- 
portioned to the bit weight. These current paths are summed and converted to 
an analog voltage output. The pertinent characteristics are listed below: 
Inputs: All inputs are logic levels 

8-15 bit digital value 

i 

Outputs: -10 to +10 Vdc, at 10 ma 

Accuracy: 0.05% - 0.25% full scale +_ 1/2 Value of the leas.t-., . 

significant bit (LS8) of digital output 
Settling Time: 100 microseconds to 0.1% of final value - 

Reliability: 200,000 hours MTBF 

Quantity: 200 

t 

Discrete Signal Drivers 

These drivers respond to logic level input pulses by storing data and 
supplying an open circuit or ground return path to bilevel indicators such as 
lights or flags. These drivers may be either packaged at the crew station or 
within the same cabinet containing the minicomputer. In either case, they are 
considered to be a part of the data conversion equipment. The pertinent 
characteristics are listed below: 
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Input: Logic level signals 

Outputs: High impedance, open circuit 

Low impedance to ground 
Quantity: 2,500 

Reliability: 2,000,000 hours MTBF 

Analog to Digital Converter 

These converters take analog signal levels and generate equivalent binary 
values in digital format. A convert command initiates a comparison operation 
between the incoming analog signal and an internally generated reference volt- 
age. This voltage is generated using digital to analog conversion. When * 
coincident comparison is achieved, the digital bits required to generate the 
reference voltage are output as the digital representation of the incoming 
analog value. Following are the pertinent characteristics: 

Input: -10 to +10 Vdc 

Convert command - logic levels 
Output: 12 to 15 bits of data - logic levels 
Accuracy: 0.02% to 0.25% full scale +_ 1/2 LSB 

Resolution: Value of least significant bit 

Conversion Rate: 50,000 words/sec 

Quantity: 1 

Reliability: 100,000 hours MTBF 

Buffer Amplifiers 

The buffer amplifiers have high input impedance to prevent loading the 
analog sensor or parameter being measured, and a low output impedance in-order 
to properly match the relatively low impedance of the ADC. This low impedance 
interface is required to eliminate any significant inaccuracies in the measure- 
ments caused by the presence of many analog channel select switches connected 
in parallel. The signal amplitude is not altered as it goes through the buffer 
amplifier. Following are the significant characteristics: 
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Input: -10 to +10 Vdc 

Output: -10 to} +10 Vdc 

Accuracy: 0.1% full scale 

Input Impedance: 10 megohms minimum 

Output Impedance: Less than 10 ohms 

Settling Time: 10 microseconds to 0.1% of final value 

Quantity: 100 

Reliability: 200,000 hours MTBF 

Analog Channel Select Switches 

There is one of these switches between each buffer amplifier and the ADC. 
They are used to select which channel is to be digitized, connecting its 
corresponding buffer to the ADC, in accordance v/ith channel select commands 
from the digital input multiplexer. The switches - discussed here are MOS-FET 
semiconductor switches. Below are the pertinent characteristics: 

Inputs: -10 to +10 Vdc analog signal 

Switch ON/OFF control - logic level 
Output: -10 to +10 Vdc analog signal 
ON Resistance: 300 ohms nominal 

OFF Resistance: 100 megohms nominal, 10 megohms minimum 
Switching Time: 2 Microseconds 

Operating Power: 25 milliwatts nominal 
Accuracy: + .001 volt 

Reliability: 2,000,000 hours MTBF ! 

Digital Input Multiplexer and Address Decoder 

The function of this section of logic is to select which data are to be 
input to the minicomputer at each word transfer of a read operation. It is 
this logic that decodes the 10-bit input address to determine which group of 
16 discrete lines will be transmitted from the simulator equipment, or which 
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analog input from the simulator is to be connected to the ADC ‘for digitizing 
subsequent transfer to the minicomputer. The following significant char- 
Veteri sties are: 


All signals are at logic levels 

Inputs: 16-bit word from discrete select logic 

12-15 bit word from ADC 
10-bit address from Tnpu.t address counter 
Transfer control commands • from- I/O controller 
Outputs: 16-bit data word 

125 discrete group select lines 
100 analog channel select lines 
Start conversion to ADC 
Reliability: 100,000 hours MTBF 


8.2.2 Failure Mode Analysis 

Failure mode analysis for the data conversion equipment is performed at 
the functional LRU level'. Except for the ADC’s, DAC’s and buffer amplifiers, 
which are generally packaged as integral units, the other LRU’s in the DCE are 
defined functionally even though they are made up of several independently 
packaged, replaceable integrated circuit modules of digital logic. 

Table 8'. 2-2 lists the various symptoms that may .arise during faulty per- 
formance by the DCE. This table identifies the LRU which is the possible source 
of trouble, and the type of fault affecting operation of this LRU. 

The following paragraphs discuss in more detail the failure modes summarized 
on the Table. In this discussion, the terms output and command are used synoni- 
mously to represent data issue from the interface minicomputer to the DCE; the terms 
input and response refer to data from the DCE to the minicomputer. 

8. 2. 2.1 Command Sent to Wrong Channel 

Transfer of data at the minicomputer interface is done in block form, as 
described in Section 8.2.1 . It is possible that an analog or discrete command 
intended for a given channel is routed to another channel; for example, an 
analog command to display a change in altimeter reading may instead cause' a.;- 
^j^riation in the fuel tank pressure displayed, or a command to change the TO/’ • 

FROM indication on the HSI may instead cause an APU FIRE indication to be turned 
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• EXTERNAL SYMPTOM 

I/O 

CONTROLLER 

ADDRESS 

.COUNTER 

OUTPUT 

ROUTING 

m 

DISCRETE 

DRIVERS 


ACC 

• 

DUFFER 

AMPLIFIERS 

ANALOG 

CHANNEL 

SELECT 

SWITCHES 

HR 

Command sent to wrong channel 

-No output 
address 
counter 
advance 

-Failed bit 
to one or 
zero 

-Failed 
logic cle- 
ment In 
address 
decode 


. a* 

■ 




- 

Failure to Issue analog command 

fflj 

vSg 

BB '-.it&k 
Hfu TKsm 

-Failed In 
discrete 
channel 
range 


-Failure to 
perform 
digital to 
analog 

• 



• 


• 

. 

-Unable to 
ti-uns for 
data to or 
from mini- 
computer 
-Faulty dat; 



conversion 


- 

t 

• ‘ 




Failure to set or reset a 
discrete signal 

UdEiS^R 



-Failed' 

discrete 

driver 



■ 


- 

Wrong value output on analog 
channel 

bus Inter- 
face com- 
ponent 

-I at led com 
pqnont In 
counter 
logic. 
Erroneous 
start add- 
ress or 

-Logic 
element . 
failure 
In data 
routing 
circuits 

-faulty 

conversion 

circuitry 

-Faulty 

reference 

suoply 


i‘ 1 

t-* 


i 



Wrong value input to minicomputer 
from analog channel 


• 1 


* • 

-Faulty 

conversion 

circuitry 

-Degraded . 
or failed 
buffer 

-Unable to 

switch 

’ 

-Logic 
. element 
fal lure 

• 

nonsequen- 
tial count- 
er advance 




t i 

Wrong analog channel Input to 
ml ni ernputer 

* * 



• 

■ * * 



amplifier ' 

correct 
buffer 
output to 
ADC 

selects 

wrong 






, 



channel 

Unable to Input analog data to 
minicomputer 

•faulty bus 
interface 
control 
logic 
component 





, 



-Palled In 
discrete 
channel 
rouge 


♦ * 

• 


-Failed 

ADC 

, 

-Unable to 
select 
analog 
channel 

* • 1 

Unable to Input discrete data 
to minicomputer 

-Faulty 
1 Inc 

driver or 
receiver 
-Disconnect- 
ed 1/0 
cable 

-Failed In 
analog 
channel 
range 

♦ 

a 


• • 

-Failed 
logic ele- 
ment In 
address 
decode 


- 


-Logic 
element 
fal lure 
prevents 
discrete 
data- 
select 

Unable to transfer data to or 
frpn minicomputer 



• 

< ’ 

* 
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Y on. This situation may be caused by faults in either the I/O Controller, 

- ' 

input address .counter, or output routing logic circuitry. 

If the I/O Controller fails to issue the counter advance signal to the 
. address counter, the. output data will be routed to the channel identified by 
the previous count. •This kind of failure would. most likely manifest itself by 
a solid "zero" count, not affected by an output transfer of data. • In this 
case no analog or discrete data would be routed to any channel since channel 
"zero" is not assigned a channel. \ ■ 

t 

, » 1 

i 

The address counter logic could fail in such a way that only channel num- 
bers that are multiples of 2, 4, 8, etc. can or cannot be loaded with data. 
This kind of fault could be caused by failure of a flip-flop in the one or 
zero state, or by failure of a logic gate in the counter sequencing logic. 
Failures of this kind would cause many commands to be routed to channels for 
which they were not intended. . . 

1 A special case of counter faults discussed above would lock the counter 

in the discrete channel range, thereby preventing analog data to be routed to 
the analog channels for which they were intended. 


The output routing logic is the most likely area for developing a fault 
that would cause erroneous steering oif data. This logic is. dependent on proper 
operation of gating to determine which channel is to receive the information. 
Failure of a gate would cause misdirection of data to the wrong channel. 


8. 2. 2. 2 Failure to Issue Analog Command 

This type of failure generally becomes evident by absence of movement in 
instruments, visual element, or motion base component when the minicomputer has 
issued an analog command to cause such movement. This failure can be caused 
by any of the following conditions: 

- I/O controller is unable to conduct communication sequences with the 
minicomputer, or does not transfer data on the minicomputer bus to the . 
DCE section for which it is intended. This fault could be caused by 
faulty logic circuits in the- controller. 
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- Output address counter is locked in the discrete channel range, thereby 
preventing routing, of analog data to analog channels. 

- The digital -to-analog converter for the selected channel has failed and 

is unable to generate analog signals from digital data sent'by the 
minicomputer. ■ • •' ; 

* * i 

8. 2. 2. 3 Failure to Set or Reset a Discrete Signal 

When this type of failure occurs, a bilevel indication such as a light or 

flag does not change states when commanded to do so by the minicomputer. The 

# 

most likely sources of the problem are: 

- I/O controller is unable to. achieve a successful transfer of data from 
the mini computer’,' either because of a failed logic component or line 
driver or receiver. 

- Output address counter may be unable to advance or is locked in the dis- 
crete channel range. 

- The driver associated 'with the particular discrete signal has failed. 

8. 2. 2. 4 Wrong Value Output on an Analog Channel 

Erroneous analog outputs, except for excessive deviations from .expected 
values, present probably the most subtle and therefore difficult to detect 
symptom during operational usage of the simulator. For example, if a radio 
navigational aid has been commanded by the computer to indicate a heading of 
351 degrees, but the instrument displays 322, the pilot very likely would 
accept this heading as correct, and initiate a ,29 degree right turn maneuver 
for the entire vehicle. Unless there are redundant displays, or other support- 
ing cues the man would be reacting to an erroneously displayed situation with- 
out being aware of any discrepancy. In this case the training personnel at 
the IOS, or the computer itself would point an accusing finger to the innocent 
trainee. 

Automatic checkout of the analog output paths can detect any of the follow- 
ing sources of erroneous analog outputs: 

- I/O controller is unable to achieve a successful transfer of data from 
the minicomputer. This situation could prevent the alteration of a 
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previously issued analog value, or cause the transfer of erroneous data 
through the failure of a logic or bus line interface component. 

- The output address counter may have a failed component that would cause 

nonsequential count or erroneous start address initiation. Either one 
of these faults, would .misdirect data so that the wrong value would be 
sent to the analog channel in question. - . 

- Output routing logic component failures could cause misdirect data so 
that the wrong value would be sent to the analog channel in question. 

- Output routing logic component failures could cause misdirection of data 
as described above. However, in this case, the problem is more likely 
to be localized to a particular channel or group of channels. In con- 
trast, an address- counter problem- usually propogates to the- entire 

set of output channels, possibly including both analog and discrete 
outputs . 

- The digital -to-analog' converter is again, the most likely source of 
problems. Erroneous analog outputs can be caused by faulty performance 
of the conversion circuitry due to, failure of any of the many components 
involved. A special' case of faulty conversion is that caused by improper 
calibration or degraded performance of the analog voltage reference 
supply. This situation becomes -evident by the- consistently inaccur- 
ate operation of all open loop, analog driven eTements in the simulator. 

8.2.2. 5 Wrong Value Input to Minicomputer on Analog Channel 

The existence of this problem is generally not easily detected by the crew 
or training personnel during normal operation. However this may not be the 
case if the problem occurs in a channel that causes immediate and obviously 
erroneous issuance of commands from the computer to simulator components being 

monitored at the time. The faults that most likely cause an erroneous analog 
input are: 
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- I/O controller faults, as described .above for outputs, can also' cause 
erroneous analog ijnputs. 

- The analog-to-digital converter is the most likely culprit in the trans- 

fer of erroneous analog values to the minicomputer. A failure in the 
built-in. reference voltage supply, or comparing digital- to-analog con--"”' 
version circuitry -could cause inaccurate analog to digital conversion ■' ' 
of simulator signals. \ 

- The buffer, if degraded, may "have variations in the unity gain- character- 

. istic of this amplifier, thereby presenting an altered signal to the ADC. 

- If the analog channel select switching circuitry is faulty, it is possible 
that the desired channel cannot be switched from the buffer on the ADC. 

It is possible, although not a likely mode of failure for semiconductor 
switches, that the ON resistance could be exceedingly high thereby re- 
ducing the level of the buffer output signal as fed to the ADC. 

- A logic fault in' the input multiplexer can also input erroneous values 
to the minicomputer by selecting the wrong channel to .be connected to 
the input bus. 

8. 2. 2. 6 Wrong Analog Channel . Input- -to Minicomputer ” 

The comments above regarding wrong values input are also applicable to the 
case where erroneous channels are being connected to the input bus. Again, this, 
type of failure becomes evident to the operating crew only when the channel 
affected has significant impact on the human sensors, or when the fault is such 
that all channels are selected erroneously. Sources of wrong channel input 
selection are: 

- Input address counter could have faulty logic circuitry affecting the 
starting address- or count sequence. A fault in the counter would most 
likely misdirect all channels. 

- Analog channel select switching, if faulty would not accomplish the 
correct channel connection from buffer to ADC. 

- The input multiplexer is the most likely source of this kind of problem. 
Erroneous decoding of the input address count could cause erroneous 
selection of channel to be input to the minicomputer. 
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8 ^ 2 - 2. 7 Unable to Input Analog Data to Minicomputer 

The development of this problem would very readily become evident to some- 
one in the simulator as he would be unable to alter the course attitude, or 
power setting of the vehicle with the activation of hand controllers, levers, 
or throttles.. Possible faulty areas are: 

- I/O controller, as in the output case, could have logic or line inter- 
face circuit faults that would prevent a successful data transfer. 

- If the input address counter should fail in the discrete channel range 
of the count, no analog data could be sent to the minicomputer. 

- Failure of the analog-to-digital converter would affect data conversion 
for all analog channels, and therefore prevent successful transfer of 
analog simulator data to the minicomputer. 

- The input multiplexer could be the possible source of this fault if 

unable to issue channel select signals to- the- analog channels in question. 

- «* , • 

8. 2. 2. 8 Unable to Input Discrete Data to Minicomputer 

Again, as in the case of no analog inputs, failure to input bi-level data 
would soon be noticed by the crew as no control could be exercised by means of 
two position switches, or digitally encoded analog devices such as hand con- 
trollers. Sources of this kind of problem are: 

- The I/O controller cannot accomplish a successful input operation because 
of any of the reasons discussed above. 

- The input address counter could have a logic failure that v/ould lock it 
in the analog channel ranqe. 

- The digital input multiplexer could have a failure in its input address 
decode circuitry, and thereby be unable to select a group of discrete 
channels. A special case of failure in this circuitry could cause 
erroneous selection of discrete channels. This problem would be gener- 
ally not obvious unless it affects a channel, of- significant interest 

at the time. 
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( 8. 2.2. 9 Unable to Transfer Data to or from the Miniconmuter 

This would' be one of the- most severe, and therefore obvious failures. 

The most likely sources °f' hardware - failure are the I/O controller logic cir- 
cuits in any of the modes described above, or a simple cable connection fault. 

The information documented here regarding failure mode sources will be 
used in determining the automatic checkout and fault isolation sequences that 
follow. 

8,2 .3. Checkout Techniques 

In developing the checkout techniques for the DCE, the bulk of the analysis 
is centered around various loop closure techniques. Various methods of closing 
the loop are considered and’ analyzed for both’ the analog channels and the digital 

channels. Various hardware options for implementing each of these loop closure 
methods are- detailed. In addi ti on- -to' -loop ^closure, other techniques are also 

analyzed. 

I ' — " 

Loop closure techniques for the analog channels are discussed in subsection 

8.2. 3.1. Discrete channels are addressed in subsection 8. 2. 3. 2. Other. 'techn.i r . 

ques considered for DCE checkout are discussed in subsec.tion 8. 2. 3. 3. Test 

software flows are presented and discussed in subsection 8. 2. 3. 4. 

8. 2. 3.1 Loop Closure of Analog Channels 

The recommended loop closure configuration for checkout of the analog sig- 
nals is -shown within the dotted lines in Figure 8.4-3. The following para- 
graphs discuss the configuration, the hardware options within the configuration, 
and the reasons for selection of the configuration. 
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Recommended Loop Closure Method 

The outputs of the digital -to-analog converters are tested through the 
test multiplexer and ADC, and the analog inputs are tested by applying signals 
from the DAC's through the single pole, double throw switches to the inputs. 

In the reference configuration there are 200 analog outputs and 100 analog 
inputs that must be switched. In performing the switching it is not necessary 
to disconnect the analog outputs from the simulator since the limits of the 
output voltages do not exceed the limits of the simulator equipment. However, 
it is required that the inputs be switched from the simulator to the DCE analog 
outputs in order to prevent interference of simulator signals with test signals. 

By providing separate monitoring and conversion for test, there is no' 
degradation to the simulator data paths. The alternative to providing separate 
conversion is to increase the quantity of multiplexer inputs to the ADC in the 
simulator data path. Figure 8.2-2 shows- the-, equivalent circuit for inputs 

from the simulator with a buffer amplifier between each switch and the driving 
source. As can be observed from the equivalent circuit, additional switches 
have the effect of increasing the capacitive loading thus increasing the switch- 
ing time. In addition, the loading to the driving source is increased. This 
increase in loading- presents- no.-problem- if- the' buffer' amplifier' output 
impedance- is low; however, inaccuracies, result- if the- impedance is high ' 
or the amplifiers eliminated and the switches driven by higher impedance sources 
such as potentiometers, etc. 

The equivalent circuit for the test inputs with the switches tied directly 
to the driving source and one buffer amplifier is- shown in- Figure 8.2-4. As 

can be readily observed from the equivalent circuit, if R g is small the error 
through the multiplexer is negligible, i.e., 300 divided by 3.3M or 0.008% for 
200 switches and a buffer amplifier with 10M input impedance. Since R s is 
negligible for the DAC's, the error through the switches is small for the test 



FIGURE 8.2-4 EQUIVALENT CIRCUIT WITH ONE BUFFER AMPLIFIER 
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loop; therefore! buffer amplifiers are not required in front of the switches as 
is the case for inputs from the simulator since some simulator driving sources 
such as potentiometers have high source impedances. 

Additionally, having a separate test data path allows for more flexibility 
in differentiating between failures of analog outputs and analog inputs. Each 
of the first 100 analog outputs may be routed through either one of , two ana-log 
inputs for test: the test input or the normal input. For example, -data -is out- 

put to DAC No. 1 and measured through test analog input Mo. 101; a. failure is 
detected. The failure may be isolated to output or test input by routing DAC 
Mo. 1 through normal input No. 1. 

For the test input, the multiplexer must have the capability to drive high 
impedance loads', shov/n in Figure- 8.2-4 accept' plus and' minus inputs, and have 

fast switching cpaability to permit extensive multiplexer sequencing during 
test. The M0S-FET‘s described below meet these requirements. Relays tend to 
be eliminated by the switching rate requirement. 

The double throw sv/itches in the analog input loop may be all switched prior 
to test with the requirement that the switches be settled before test. Thus, 
relays or similar type sv/itches may be used. MOS-FET's may also be used for 
this application; two MOS-FET's are required per switch. 

MOS-FET semiconductor sv/itches may be used for the multiplexer and the 
double throw switches. These MOS-FET switches are reliable and have high 
switching speeds; the "off" resistance is nominal. The operational character- 
istics for these switches are listed in paragraph 6. 4. 1.4. 

The packaging is small for the MOS-FET's; two to four switches with drivers 
can be packaged in one dual-inline integrated circuit. The estimated cost of 
parts for the system of 200 switches is $2,500. 

Relays are reliable, provide low "on" resistance, high "off" resistance, 
and high current capability. Generally, the switching time is very low compared 
to other methods. Also, the pov/er required for operation is relatively high 
and usually require additional driver circuits. Some characteristics of relays 
in the general class of interest are as follows: 
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Reliability - 100 million operations 
On resistance - 200 milliohms 
Switching time - 1.0 milliseconds 
Off resistance - 10,000 megohms 

Operating power - 50 milliwatts •. * 

Due to the low current. requirements', the packaging is small: dual— inline pack- 
ages or equivalent. The estimated cost for the system of 300 switches is $2,500 
for parts. ' 

Other Configurations 

Four other configurations were considered for closing the loop; however, 

these did not appear adequate enought to be recommended for -implementation. The 

following paragraphs discuss these configurations. 

♦ » 

. . . «... ^ , 

Crossbar Matrix - The crossbar provides the - capability of switching inputs to 
outputs in a matrix configuration, as shown -in- Figure 8.2-5. The switching of 
.the 100 inputs to the 300 outputs (200 - DAC's - and 100 simulator outputs) - requires, 
as a minimum, two 10 x 30 x 6 crossbars. This configuration .however, is not 
a universal matrix but is limited to switching - any group of six - inputs to any 
group of six outputs/. - Additionally , -connections maybe made only inside each 
crossbar. This' 'switching technique is more than adequate for. isolating fail- 
ures, however, since the - capability - of - , switching betv/een only two - separate paths, 
for each signal'is required for isolation. 

Crossbars are reliable, provide low "on" resistance, high "off" resistance 
and high frequency range. The switching time is very slow and the power re- 
quired for operation is high. Typical characteristics of the crossbar are as 
follows: 

Reliability - 100 million operations 
0M resistance - 400 milliohms 
OFF resistance - 100,000 megohms 
Switching time - 18 milliseconds 
Operating power - 1.5 watts 
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Th'e packaging for the crossbar switches is larger than for small relays: on 
/ the order of 2 to 3 times. The estimated cost for the two 10 x 30 x 6 matrices 
is. $4,500 for parts. 

The crossbar provides much more flexibility than is required for this 
application. The crossbar, provides the capability of switching multiple inputs' 
to multiple outputs; whereas, switching between two data paths is sufficient 
for fault isolation. The major drawback to the crossbar is the switching time 
of 18 milliseconds. Using two 10 x 30 x 6 matrices, the crossbar must be 
switched twice: before checkout starts and in the middle of checkout. An 
additional switching will occur if a failure is detected. The second switching 
may be elimated by using four 10 x 30 x 6 matrices and increasing the input 
multiplexer from 100 to 200 inputs. Tv/o additional negatives are the slightly 
higher costs and the larger space required. 


Reed Relay Matrix - Reed relays may be configured in a matrix to switch combina- 
tions of inputs ‘to combinations of outputs ‘similar to the crossbar. The quantity 
of relays required are a function of the number- of combinations' in the matrix. 

The minimum number of’ relays required for- switching' the ‘-100 inputs* to the 300 
outputs is 300; this provides tv/o data- paths for each DAC output. Figure 8.2-6 
shows the switching configuration for the minimum number of relays. The maximum 
number for a universal 100 x 300 matrix is - 30,000 relays. The minimum number 

is sufficient since only two separate data paths for each DAC is required for 
isolating fauTts. The major drawback to the reed relays is the switching time, 
0.5 milliseconds minimum. With the minimum configuration the relays are 
switched twice for checkout and again if a failure is detected. The reed 
relays do, however, switch much faster than the crossbar. 

8. 2. 3.2 Loop Closure of Discrete Channels 

The recommended loop closure configuration for checkout of the discrete . 
signals is shown in Figure' S. 2-7. This f configuration and variations' thereof 
are discussed in the following paragraphs. Also, using relays for loop closure - 
are discussed. 
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Recommended Loop Closure Method 

The test configuration for checkout of the discrete inputs and outputs is 
shown in Figure 8.2-7. The loop is closed by increasing the input capability 

of the digital input multiplexer. The output discretes are monitored through 
these inputs. The additional input- circuitry is shown in Figure 8.2-8. The 

circuit within the dotted lines is that required for one bit of the 16-bit 
word transmitted to the minicomputer. Thus, approximately 171 x 16 = 2,736 
additional gates .are required to monitor the 2500 discrete outputs. This 
additional input circuitry is a duplicate of the operating input circuitry 
of the multiplexer. The circuitry for both v/i 1 1 have the same address v/ith a 
test mode signal or run mode signal selecting which input. The outputs are 
OR'd at the output line drivers. The operating input gates between the line 
drivers and input signals are assumed to be operating properly. This assump- 
tion is reasonable since in automatic checkout some fraction of either the test 
or operating hardv/are must be assumed correct. For example, if relays are used 
to switch input signals, then the relay contacts to the inputs are assumed 
correct. Another reason that the assumption is valid is that the reliability 
for this group of input gates is approximately 2,000 hours mean-time-between- 
failure. The failure rate is low enough so that the failure is assumed else- 
where until all other possibilities are eliminated. The estimated cost for 
parts is* 52,000. 

Other Configurations 

Two additional configurations were examined for closing the loop for the 
discrete signals. These are discussed in the following sections. 

OR'd Input Gates - A variation of the logic diagram in Figure 8.2-8 was 
examined. This variation is- shown in Figure 8.2r9. 
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The test gates and operating gates are OR'd at the outputs of the first line 
of gates instead of at. the inputs to the line drivers. Combining the test and 
operating signals at the first gate has the advantage of checking the additional 
eleven gates per bit or 176 gates between the operating input gates and the 
inputs to the line, drivers. However, as seen in Figure 8.2-9, gates with three 
inputs are" required instead of two at the inputs. There are approximately 2500 
of these gates. The two-inputs gates are normally packaged four per integrated 
circuit, and the three-input gates are packaged three per integrated circuit. 
Therefore, approximatly 200 additional IC packages are required for the con- 
figuration 'With three-input gates. Since'the reliability is based upon the 
number of packages and not the number of gates, 'the logic configuration in 
Figure 8.2-8 will have less failures - in the - operating gates that are npt being 
tested by the loop closure than this configuration. 

Relays - Another configuration examined included the relay configuration des- 
cribed for the analog checkout in Section 8. 2. 3.1. The relays are packaged 
one per package; therefore approximately 2500 units are required or four time 
the number of packages required for implementing with .logic circuits. The cost 
for parts for the relays is estimated $15,000 or over seven times the cost of 
parts using integrated circuit logic. • 
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8. 2. 3. 3 Other Techniques Analyzed 

Sections 8. 2. 3.1 and 8. 2. 3. 2 discussed the recommended loop closure tech- 
niques for verification of the data conversion equipment. Five other techniques 
were analyzed as : to their applicability -and .value to DCE checkout. Table 8.2-3 
summarizes these techniques .and the= analysis. performed. : 

Close Loop at Crew Station 

Although this approach may be considered a packaging variation of the loop 
closure within the DCE, it does increase the level of confidence achieved by 
verifying that signal paths are i.ntact all the way to the actual crew station. 

This checkout configuration requires the installation of digital -analog- 
digital conversion elements directly at the crew station. The number of lines 
between the DCE and the crew station may be reduced by using multiplexing and 
decoding logic hardware. Data is sent in serial words from the cabinet con- 
taining the minicomputer to the conversion equipment in the crew station. 

A disadvantage, however, is the need to install the conversion equipment at 
the motion base crew station. This installation imposes extra demands on the 
load carrying capability of the motion base; the additional hardware requires' 
space that could be better used for crew station simulation equipment; and 
further, the additional power requirements increase the need for cooling equip- 
ment and for.-other environmental control facilities at the c rev/ station. 

Using Output Signal Measuring Equipment 

This technique involves the addition of fairly independent channel moni- 
toring and comparison hardware. This hardware has the capability to sequence 
from channel to channel reading and comparing its output to a value previously 
defined by a computer output to the test hardware. If a channel is found to be 
out-of- tolerance the hardware stops sequencing and the sequence counter value 
is sent to the computer as an identifier of the faulty channel. Sequencing 
then is restarted, and continued until all channels are checked. 
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CLOSE LOOP 
WITHIN DCE 

- ADD 200 SEMICONDUCTOR SWITCHES 
FOR’ ANALOGS 

- ADD 1 ADC 

- ADD 1 BUFFER AMP 

- ADD 2500 GATES FOR SWITCHING 
DISCRETES 

ALL ABOVE TO BE ADDED WITHIN 
DCE CABINETS 

EXTENSIVE RECONFIGURA- 
TION, STIMULI AND 
RESPONSE READ COMMAND 
SEQUENCING, TOGETHER' 
WITH RESPONSE ANALYSIS 
PROCESSING FOR FAULT 
ISOLATION REPORTING 

MODERATE LOW 

- DOES NOT CHECK CABLING FROM 
DCE TO CREW STATION 

- DOES PROVIDE TEST' CAPABILITY 
FOR ACTUAL DATA CONVERSION 
EQUIPMENT TOGETHER WITH 
ADDRESSING AND SELECTION 
LOGIC 

CLOSE LOOP 
AT CREW 
STATION 

- ADD ALL COMPONENTS LISTED 
ABOVE PLUS 

- ADD MULTIPLEXING HARDWARE 
IN CREW STATION' TO REDUCE 
DCE TO CS LINES 

'same .as above 

MODERATE • 

- CHECKS SIGNAL PATH ALL THE 
WAY 10 THE ACTUAL INSTRUMENT 
OR ACTUATOR DRIVE SIGNAL 

- ADDS WEIGHT, SPACE, 

AND POWER REQUIREMENTS ON 
CREW STATION INCLUDING MBCS 

ADD OUTPUT 
.SIGNAL 
MEASURING 
EQUIPMENT 

- ADD REDUNDANT SET' OF INPUT DCE J 
I/O CONTROLLER, MULTIPLEXER, 
ADC, BUFFER AMP, ETC. PLUS ' • 

. SIGNAL COMPARING CIRCUITRY AND 
CHANNEL SEQUENCING LOGIC 

SAME AS ABOVE BUT LESS 
RESPONSE ANALYSIS 
PROCESSING 

- ADD DEVICE HANDLER 1 
FOR TEST EQUIPMENT 

MODERATE , 
HI ON HDWE 

MODERATE 
LOW ON SFWE 

- PERMITS ON-LINE MONITORING 
WITH QUICK FAULT DETECTION 
CAPABILITY 

- CHECKS ONLY OUTPUTS 

ADD INPUT ' 
SIGNAL 
SIMULATION 
EQUIPMENT 

- ADD ONE I/O CONTROLLER, ONE 
ADC, BUFFER AMP, SWITCHING 
LOGIC, AND CHANNEL SEQUENCING 
LOGIC 

SAME AS ABOVE BUT WITH 
EMPHASIS ON RESPONSE 
ANALYSIS 

MODERATE 

- CHECKS ONLY INPUT PATHS 

ADD DOTH 
OUTPUT MONITOR 
AND INPUT 
SIMULATION 
EQUIPMENT 

- ADD ONE I/O CONTROLLER PLUS 
ALL OTHER HARDWARE FOR ABOVE 
2 CANDIDATES 

SAME COMPLEXITY AS 
CLOSING LOOP BUT LESS 
INDIVIDUAL CHANNEL 
DATA BASE PROCESSING 

HIGH 

- INCREASES COMPLEXITY AMD 
QUANTITY OF HARDWARE ADDING 
POSSIBLE SOURCES OF FAULTS 

ADD ADDRESS- 
ABLE STATUS 
MONITOR 
REGISTERS 

- ADD 8000 LOGIC GATES TO SWITCH 
ANY LINE ON TO THE MINICOMPUTER 

- ADD TEST ADDRESS DECODE LOGIC • 

- ADD TEST SEQUENCE CONTROL LOGIC 

- SAME COMPLEXITY AS 
FOR CLOSING LOOP, EX- 
CEPT NOT AS EXTENSIVE 

- COMPLEX FAULT ISOLA- 
. TION ANALYSIS 

MODERATE 
ON HDWE 

HIGH ON 
SOFTWARE 

- PERMITS DETAILED FAULT ISOLA- 
TION BEYOND LRU AND DOWN TO 
COMPONENT LEVEL 
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The test sequence is as follows: 

1. The computer iss'ues a reference bit pattern to the test hardware. 

2. The same pattern is issued to each analog output channel. 

3. The test sequence is started at the test hardware. Each analog 

channel is compared, after being digitized, with the reference bit 
pattern. Tolerances are defined and allowed for in the comparison 
operation. ) 

4. Comparison out-of- tolerance is followed by an interrupt to thfr computer 

and the subsequent transfer of identifying address .of faulty channel 

• • 

to computer. 

5. Reference 'bit pattern is sent by the computer to groups of discrete 
signal drivers. 

6. Test sequence then is initiated for discrete channels. No tolerances 

. are allowed in comparison because deviation in any single bit indicates 
fault in a .discrete channel. 

7. Faulty comparison causes the generation of an interrupt, followed by 
transfer of group address and pattern read to identify faulty channel. 

8. Other bit patterns, different from those issued above, are then used 
to verify that all bit positions in output channels are operating 
correctly. 

i - v 

The additional hardware is more complex than that required for connecting 
output lines to input channels. However, software is simplified in that only 
a few data patterns are stored for outputs of stimuli, and no comparison or 
channel identification software is needed as these functions are performed by 
the hardware. 

i „ 

A significant advantage of using output measuring hardware is the ability 
to perform on-line monitoring of output generation equipment performance. With 
some additions to the hardware and the DCE device handler software, every out- 
put can be routed both to the test hardware and the actual DCE. Comparison is 
performed while the output block transfer is being accomplished. If a faulty 
comparison occurs, the computer is notified by the hardware and an error re- 
covery routine intitiated to determine whether a fault in that particular 
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channel warrants an abort, a retry, or no' action at all. A possible drawback- 
to this type of on-line monitoring is that a failure' in the test hardware could 
impair performance .of the simulator when actually the operational hardware is 
healthy. 

Using Input Signal Simulation' Equipment 

This technique is quite similar to the output measuring technique dis- 
cussed above. However, the emphasis is on checking the integrity of input 
channels. 

The philosophical argument for thoroughly checking output or input only is 
based on the increased confidence obtained by daily checking that half of the 
system that is the largest source of abortive failures. For the reference con- 
figuration used in this study, the output section is the one to be- checked 
daily. This section is larger in component count and contains more digital/ 
analog conversion equipment than the input section. 

The section which does not get the daily verification is checked less fre- 
quently, say on a monthly basis. The lower frequency requirements for this 
checkout permits the use of less automated techniques which although take longer 
to perform, .are used to detect incipient failures at an overall reduced cost 
for the life of the program. 

Using Automatic Test Hardware Both on Input and Output Paths 

This technique is an integration of the two configurations above. The 
presence of test hardware on both output and input has the advantage of higher 
confidence level in readiness status of the simulator, plus the additional 
benefits of on-line monitoring for output channels. 

Major disadvantage is the added cost of test hardware in that the -hardware 
added represents a nearly 802 increase in total component count. Clever design 
in switching and multiplexing circuitry could reduce this estimate somewhat, 
but even then the magnitude of added complexity may tend to reduce reliability 
of the system rather than enhance it as intended. 
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Add Addressable Status Monitor Registers 

This technique requires addition of gating logic to connect various opera- 
tional bi-level component outputs to the minicomputer input bus. Additional 
registers are required to store status information, as well as the occurrence 
of predefined events or sequence of events. These registers have information 
regarding existence, or loss of synchronization either in timing or serial trans- 
fer operations, as well as a record of past successful or erroneous activities 
such as the number of channels activated and whether a checksum or parity error 
occurred during a data transfer-. 

« 

The major advantage of this technique is the extensive automatic fault 
isolation capability available. In effect, the DCE has test points at all the 
important lines that contain digital information regarding the operational cap- 
abilities of the equipment. These test points permit identification of the 
faulty flip-flop, or even gate, whenever a fault is found to exist. 

The major disadvantage of this technique is that no actual analog outputs 
are verified, and therefore the performance of the digital-to-analog converters 
is not checked. Only those paths containing digital data are instrumented. On 
the input side, no check of buffer amplifiers or ADC is achieved. 

Softv/are complexity for this technique is excessive in that the software 
must maintain a virtual logic diagram of the DCE in the data base. This infor- 
mation is needed in the process of isolating the faulty component in the event 
of a failure. 

8. 2.3.4 Test Softv/are For Closed Loop DCE Checkout . . 

The flow chart for verifying the-data- paths.. is shown, in- .Figure 8.2-10 
Values are transmitted to each digital-to-analog converter from FS (full scale) 
to -FS. The values selected are +FS, +1/2FS, +0, -0, -1/2FS, -FS. Using these 
values all bits are exercised; the linearity is checked; the full scale refer 

4 

ence is verified; and the zero offset is checked. These values are set in 
memory in sequence from +FS, to -FS; i.e., address n contains +FS, n+1 , 1/2FS, 
n+2, +0, etc. Each DAC receives one value during a block output. Because of 
the location of data in memory, each adjacent DAC has a different value 
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with each value repeating every seventh DAC. ' By sequencing' the output in 
this manner channel selection and crosstalk are verified. Additionally, the 
same values are output to the discrete channels. All bits are tested and 
sufficient values are output to verify crosstalk and channel selection. . 

* 

j 

Other data val ues- considered but rejected for checking the data paths . 
are: to output ‘from -FS to +FS in increments of one binary bit or to output 

5252 and 2525. Outputs in steps of one binary bit is the most comorehensive 
test that can be made since every possible combination of bits is output. 

However, outputs of every combination require considerably more time and memory 
than the limited quantity of values proposed above since each value must be 
transmitted and stored in a memory location. A limited quantity of outputs is 
adequate to verify that the equipment is functioning properly since it is 
assumed that the equipment has passed an initial acceptance test verifying that . 
the equipment at one time functioned properly, was wired correctly, etc. 

Outputs of 5252 and- 2525 exercises all bits since this combination represents 
alternate bit patterns. A disadvantage of this combination is that full scale 
and zero offset are verified only by extrapolation. For instance, the loop may 
be within tolerance with a 5252- value, but the output of an analog unit in the 
loop may saturate with a full scale input because of power or component condi- 
tions before full scale output is reached thereby causing full scale output to be 

of-tolerance. Also, crosstalk .verification is limited since only two values 
are output. Additionally, because only two values are output, verification 
that the correct channel is responding is limited since there is a good chance 

that the correct value will be input^even though the incorrect channel is re- 

sponding. This deficiency may be corrected by outputs to only one channel at 
at time with all other channels zero or full scale. Outputs to one channel v/ith 
all others' full scale also adequately verifies crosstalk. Another- disadvantage 
is that outputs in this manner are very time consuming because a block of data 
is output for each value resulting in two blocks per channel.’ 
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After the range of data ,is output to all channels and input thru the input 
channels, ' inputs are compared to outputs. If all channels are within tolerance, 
the system is functioning properly. If any channels are out-of-tolerance, 
these channel addresses- are noted and the program branches to the fault isolation 
routine. 

8. 2, 3. 5 Fault Isolation 

The first step in the fault isolation process is' to examine the faulty 
channel addresses to determine if any discrete channels are failed. If there 
are discrete channel failures, the program is branched to a fault isolation 
routine. The first step of the discrete fault isolation routine is to deter- 
mine the quantity of bad channels. 

If all the channels are defective and the input data is not changing with 
different outputs, then the failure is likely the address counter or the con- 
trol signals in the input/output controller. If all the channels are defective 
and' one or more bits remain constantly a one or zero, then the failure is in 
I' the transmission of data through the digital output routing, digital input mux, 

I/O controller, line drivers or line receivers. 

* 

If multiple channels are failed, further tests are performed. All one's 
are output to the faulty channels in turn with zeros to all other channels. If 
the data is returned thru the wrong channel, then the address is incorrect. 

This indicates a failure in the address counter, address decoder, or line 
drivers or receivers for transmitting the address. 

If' the channel addresses are correct, the bits are examined in each channel- 
to determine if the same bit is failing in each channel. This type failure 
indicates a failure in data transmission through the digital output, digital in- 
put multiplexer, or the line drivers or receivers transmitting the data. 

If one or more channels are failed with no correlation to other channels, 
then the fault is likely in the digital storage, address decoder or input mux. 
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After the discrete, channels are checked, the failed channel addresses are 
examined to determine if jany analog channels are failed. If there are analog; 
fail ures, the next step in the fault isolation process is to determine the 
quantity of faulty channels. This, quantity is grouped into three categories: 
all channels, one channel, or multiple channels bad. If all the channels are 
faulty, this indicates tha.t the error is either in transmitting digital data 
to the analog devices or in receiving data from the analog devices! The 
nature of the failure may further pinpoint the faulty LRU. If one or more 
bits are consistently dropped, then the fault is in either the input/output 
controller, the output routing, or the. digital input multiplexer; that is, 
the fault is occurring in the digital word as it is transmitted between the ■ 
minicomputer and analog devices. • ‘ 

If other inputs occur, such as constant inputs or inputs with no apparent 
relationship to the outputs, then the control circuitry is likely at fault: 
either the .input/output controller is not transmitting the correct timing signals., 
the control signals are not received by 'the digital output routing or input 
multiplexer, or an address counter is not functioning. An out-of- tolerance 
condition with no defective bits is likely caused by either the reference or 
power' suppl ies out of tolerance. " ' . 

If only one channel has failed, the failure is isolated to a sinqle chan- 
nel. To further isolate the failure the output may be switched to a different’ ' 
input channel. If the fault does not appear thru this input, then the first 
input channel is failed. If the fault is still present, the analog output is 
at fault. For the situation in the test, configuration where 100 of the 200 
channels cannot be switched to an alternate input, the test hardware must be 
assumed .to be correct. This is. a reasonable assumption because for the test 
hardware to fail, either the multiplexer switch or the switch channel select 
circuitry would have failed. From the reliability data for these components, 

■only one failure occurs in the group of 100 switches every 20,000 hours. This 
failure rate is low enough not to warrant redundant input switches. When the 
choice is between the analog output and multiplexer switch, the failure will 
be assumed in the analog output path, and for those few instances when these 
units are checked to be good, then the input switch will be replaced. 
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8.3 CONTROLS AND DISPLAYS 

The implementation of self test techniques for the controls and displays 
incorporated in the Crew Stations and the Instructor Operator Station, IOS, 
presents a variety of peculiar problems but at least provides a ready solution ■ 

• to one aspect of the problem, that is fault isolation. The controls and displays 
are a direct interface with the trainees and consequently an undetected perform- 
ance fault is highly likely to produce a negative training impact on the trainee. ' 
This factor increases the desirability of self test features for this, equipment. 
Provision of self test is relatively difficult, however, because both the input 
command for a control and the output of a display (for example, meter needle 
motion, indicator light illumination, etc.) are designed for interaction with 
the human operator. Consequently, self test of a control requires a ca-librated 
driving mechanism that can supply the physical force and motion that are nominally 
supplied by a crew member. Similarly, self test of a display requires sensing 
of the motion of physically small components, such as a needle, without inter- 
ference with their natural behavior. Fortunately, each of the instruments or 
displays, as well as the controls, is either readily replaceable or must be 
^removed from the installation for servicing in the event of any major malfunction. 
Rffectively, these devices are Least Replaceable Units and if self test facilities 
can detect the malfunction of any one device, then there is no further fault 
isolation to be performed. 

In the following subsections we describe a variety of means for implementing 
self test for the various displays and controls, whether they are located in the 
C rev/ Station or the Instructor Operator Station. Some of these techniques may 
be judged too expensive for practical application. This' is a judgment that 
eventually will have to be made for each specific simulator application. Our 
objective is primarily to conceive and propose these techniques and in so doing? 
establish some alternatives so that later judgment may be a matter of choice 
or cost effectiveness analysis rather than a decision by default. 

In subsection 8.3.1, we review the basic problems involved in providing 
self test for displays in general and outline the scope of the displays which 
we considered for analysis. In the following subsections we then present our 
conclusions with respect to each of the display devices analysed. 
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'Similarly, in subsection 8.3.8, we review the basic problems inherent in* 
(roViding self test capability for the various control devices. In the subse.- • . . 
uent sections we consider in greater detail the specific requirements of the 
various types of controls. 

8.3.1 Displays Overview •* • 

A display is a device that transforms /the. information,, in an electrical signal 
into a visually observed effect which can then be viewed by the crew member 
(or trainee) at his convenience. Although the electrical signal is readily 
sampled and evaluated by a computer, a truly adequate test of a display must 
be one that not only verifies that the device is operable but assesses the 
information being displayed and verifies its accuracy. Consequently, the 
problem of implementing self test for the display devices is, for the most part, 
the problem of sensing the response of an electro-mechanical instrument or the 
luminance or luminance pattern of an illuminated device such as an indicator or 
cathode ray tube. 

The specific displays considered for this study are described briefly in 
!he following paragraph. Subsequent paragraphs address the basic sensing tech- 
niques that are available for this application.- 
* • * ‘ . . 

r 

f 

8. 3. 1.1 Display Devices Considered for Analysis 

’ The display devices considered for analysis for this study consisted of 
the following: 

o Meters incorporating 'galvanometer movements 
o BC serv.o driven meters 
o Synchro/resolver driven meters 
o Lighted indicators 

o Bilevel electromechanical flags 

o CRT graphics display devices 

The meters display continuously variable parameters whose value is indicated 
by the extent of displacement motion exercised. There is no signal content in 
any lumi nation which may be provided to the device. The lighted indicators and 

) . 
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the electromechanical flags display the status of discrete parameters. The 
^lags have two mechanically possible positions and the lighted indicators have 
Either the lighted or uni ignited condition. The CRT presents continuously 
variable and/or discrete information entirely through programmed luminance 
patterns . 

4 

The available techniques for sampling the information contained ; in. .the above 
displays is discussed in the following paragraph. ; . 

8. 3. 1.2 Basic Display Response Sensing Techniques . \ ■ 

► 

The basic techniques for sensing display performance or response may be* 
divided into tv/o categories. These consist of either continuous signal or 
response measurement devices or discrete position or condition measurement 
devices. Devices that have only discrete sensing capability, such as magnetic 
switches, for example, can however, be applied to sensing the response of con- 
tinuously varying devices. 

Discrete response sensing devices or techniques considered for the displays 
^nalyses consisted of the following: 
o Photo sensors 

o Bistable fluidic sensing, elements 
o Electrical contacts 
o Snap action switches 
o' Magnetically operated switches 
• o .Thermistors 

Continuous response sensing devices considered consisted of the following: 
o Position potentiometers 
o Current sensors 
o Closed circuit TV camera 

In the following paragraphs, we will review the basic capabilities, advantages 
and penalties associated with each of the above concepts. This information is 
intended as background information in support of the evaluations made for each 
of the displays discussed in the following subsections. 
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Ph oto Sensors 

| Photo sensors are available with and without their o wn light sources and, 
with the proper circuitry, provide a light-on or light-off indication. This is 
very useful for sensing meter needle positions, since the needle shadow can be 
used to interrupt the light source and render the light-off condition. If the 
sensor has its ov/n light emitter, then the light measured is that reflected by 
an adjacent object. Again, this could be the reflection from the back of a 
meter needle if properly painted, or it might be the reflection from a spot 
painted on the back of the tape in a tape meter. Some specifications for typical 
photo sensors are reproduced in Figure 8.3-1, 


Photo sensors have several specific advantages for sensing display instrument 
position. Primary among these is the fact that there is total non interference 
with the operation of the equipment being instrumented. Secondly, they are 
relatively compact and consequently simple to install. In addition, they are 
relatively inexpensive and installation costs are likely to be a bigger factor 
than component costs. Finally, they are relatively reliable since they involve 
no moving parts and, since they operate without any electrical connection to the 
|)asic equipment, they are entirely fail safe. That is, failure of a photo sensor 
in an instrumentation application could in no way interfere with the proper 
operation of the original equipment. 


The major disadvantage of the photo sensor is that it is only useful for 
checking discrete events. That is, there is no way to obtain a continuous 
reading of instrument position except by going to a larger number of discrete 
measuring photo sensors.- 

‘ Bistabl'e Fluidic Sensing Elements 

Bistable fluidic elements can be applied as discrete sensors similar to 
photo sensors. In this case, the motion of a needle or a perforation in a tape 
is detected by v/hether it covers a control port in a bistable fluidic element. 

The air flow through the element is diverted from one stable path to another 
depending on whether the control port is covered or not. 

<► 

Again the advantage of a fluidic device such as this is relative non 
p'nterference with the free motion of the device being monitored. Reliability 
is also a basic virtue of fluidic systems. 
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PHOTOTRANSISTORS (SILICON) 


OPTICAL/ELECTRICAL CHARACTERISTICS (25°C) 


PARAMETER 

LIGHT 

CURRENT 

DARK 

CURRENT 

COLLECTOR 

BREAKDOWN 

EMITTER 

BREAKDOWN 

LIGHT CURRENT 
RISE TIME 

SATURATION 

VOLTAGE 

ANGULAR 

RESPONSE 

SPECTRAL 

RESPONSE 

MAXIMUM 

TEMPERATURE 


^ce 

5.0V 


■ 

■ 

R,_=1Q00n Vcc*5V 

l‘ c = 0 4 ins 

NOTE 1 

Figure 1 
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H as shown 
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H as shown 
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^CSO 
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tf 
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nA 
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+1 
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16 
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.* Irradtance in mW/cm2 from s tungsten source at a color temperature of 2870'*K. 
t Offered with extra lead attached to case. Suffix "L" (SO-1440*2Lh 

1. The angle between incidence for peak response and Incidence for 50% of peak response. 

2. Larger aperture for higher sensitivity; reduced angular response minimizes crosstalk. 

3. Very high sensitivity with wide field of view OrwesTTL directly, even at low irradiance levels. 

4 . Highest sensitivity available. Drives TTL directly, even at low irradiance levels. 



SD-1440 Series 

1. Emitter 

2. Collector 
Gold plated 
Kovar/Glass 


SD-1441 Series 

1. Emitter 

2. Collector 
Gold plated 
Kovar/Glass 


SD-2440 Series 

1. Emitter 

2. Collector 

Gold plated Kovar/ 
Ceramic/Glass 







SD-2441 Series 

1. Emitter 

2. Collector 

Gold plated Kovar/ 
Ceramic/Glass 


SD-3440 Series 
SD-3442 Series 

1. Emitter 

2. Base 

3. Collector 
Hermetic TO-46 


FIGURE 8.3-1 TYPICAL SILICON PHOTOTRANSISTORS AND REFLECTIVE SENSORS 

(SPECTRONICS INC.) 
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REFLECTIVE SENSOR ASSEMBLY* 




SPX 1396-2 TYPICAL OUTPUT CURRENT (! c ) 
vs DISTANCE (d) TO REFLECTIVE SURFACE 



DISTANCE FROM REFLECTIVE SURFACE, i (INCHES) 



ABSOLUTE IViAXIMUiVi RATINGS (at Standard Atmospheric Conditions unless otherwise 


specified 

- 


PARAMETER 

SPX-1396 - 

UNITS 

Liconti 

LED Forward Current, Continuous 

50' 

.. mA 

’Vr| L i 

LED Reverse Voltage 

6 

V 

v F 

LED Forward Voltage Drop at l F = 25 mA 

1.5 

V 

PD L 

Power Dissipation, LED 1 

65 

mW 

VcEO 

Collector-to-£mitter Voltage, Sensor 

20 

V 

Veco 

Emitier-to-Collector. Voltage, Sensor 

5 

V 

fc 

Collector Output Current, Sensor 

12 

- mA 

PD s 

Power Dissipation, Sensor 2 • 

65 

mW 

*^Opr 

Operating Temperature, Ambient 

-40 to +70 

"C 

Tsig , 

Storage Temperature, Ambient 

-40 to +70 

°c 


1, Derate. linearly from 25°C at 1 4 mW/®C 

2. Derate linearly from 25 C C at 0 6 mW/°C 

Maximum lead soldering temperature for 10 sec: 260 a C 


* This compact reflective assembly combines Spectronics '• solution- 
grown Light- Emitting Diode and silicon NPN phototransistor in a 
metal, epoxv-sealed package. Designed to operate at an optimum 
distance of .050 inches, -this assembly will generate a TTL- 
compatible signal when directed at a reflective surface. 


•FIGURE 8.3-1 TYPICAL SILICON PHOTOTRANSISTORS AND REFLECTIVE SENSORS 

(SPECTRONICS INC.) (continued) 
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Fluidic devices introduce several disadvantages, however. The information 
to position is contained in the direction of flow exiting the fluidic element. 
In order to introduce this information into the computer for processing, the 
signal must be converted to an electrical signal through a transducer. In 
addition, the use of fluidic sensors requires the provision of an air supply 
and the associated tubing for its distribution and return. For this application, 
these requirements render the fluidic system likely to be more costly, complex 
and cumbersome than some of the other alternatives. 

Electrical Contacts 

The installation of contacts for sensing the position of a moving indicator 
at its extreme positions is a simple and direct way of obtaining discrete infor- 
mation. Reliability is at a maximum because there is, literally, no component 
to fail except for the contacts themselves. 

The strongest advantages of the use of electrical contacts are the low 
cost for components, the high reliability and the accuracy of the indications. 

The. disadvantages of using contacts are that they restrict the free motion 
of the moving indicator either by completely stopping it at the extreme scale 
positions or by imposing a relatively high friction load. The restriction 
of the motion has the pursuant effect that loss of calibration on the one side 
cannot be detected. In addition, all of the moving indicator or some part of 
it must be conductive and the conductive part must be suitably insulated from the 
instrument case to avoid shorts. Also, conductivity of the contacts must be 
assured by the use of special metal plating or by periodic maintainance. 

Snap Action Switches 

Snap action switches are inexpensive, compact and reliable. 

Snap action switches don't offer any particular advantage for the present 
applications other than those cited above. 

Disadvantages for snap action switches are that they restrict the free motion 
| 0 f the moving indicator and they do this less predictably than do the contact 
^points. In addition, they apply this restriction before the moving indicator 
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reaches its scale limits- unless there is a substantial amount of off scale motion- 
^^vailable. Switches are more expensive and require more room than the contacts . 
previously discussed. ^ 

Magnetically Operated Switches 

Magnetically operated switches that are small and bounce-free are available 
from Microswitch Division of Honeywell as well as other sources. These switches - 
require the article to be sensed to be magnetic or to have attached to it some 
magnetic material. Magnetic sensing reed relays must then be installed at the 
points at which the passing of the magnetic material must be detected^ There 
is- no direct physical contact between the moving element and the sensors. - 


Magnetic switches have the advantage that they do not interfere in any way 
with the existing limitations on the displacement motion of the moving indicator. 
Nor do they require any modifications to an instrument that would be conspicuous 
and degrade its fidelity as a simulation. Further advantages are 'they they do 
not require a light source or light reflection which may be difficult to provide 

« ~n some instances and they do not interfere with the absolute physical motion 
^ imits of the device being sensed. 

3 * 

The disadvantages are that the magnetic material which is required on the 
moving component may change its dynamic response properties by substantially 
affecting its weight. The magnetic fields created may also interfere with the 
proper operation of the instrument. 

Thermistors 

"Thermistors are simply resistors Whose resistance is a monotonic function 

« 

of temperature. When properly calibrated, thermistors are used as temperature 
indicators. They are inexpensive and can be used to detect whether a heat 
generating light source" is on by virtue of the associated heat output. 

The advantages of the thermistor are low price and simplicity. It is 
simply a passive material with a unique property. 


The disadvantages of thermistors are the requirement for bridge circuitry 
*®fchat is normally used with them to measure temperature changes. Secondly, they 


8-84 


MCOOWrWtLI. DOUGLAS /SSYROM/MJTtGS COIVtf=-/*f\IV « EAST 



MDC El 150 
1 November 1974 


are limited to detecting heat which is 
resent study. Proximity requirements 
ppearance of the display. 


a relatively minor application for the 
for proper heat detection could affect 



Position Potentiometers 

Position Potentiometers are simply potentiometers in a voltage divider 
circuit that produce a voltage that is proportional to positional displacement 
v/hether the displacement is angular or linear. 


The advantages of position potentiometers are reliability, low cost, 
accuracy and availability. In fact, they are quite often used for generating' 
feedback signals in servo driven systems'. In this case, the voltage from the 
existing potentiometer may simply be sampled through a buffer amplifier. 


The disadvantages of a position potentiometer are that if it is not 
already present as part of a servo loop, then it may impose a friction load 
on the device drive that alters its dynamic performance if not accuracy. 

Space limitations may also.be a problem. 

,/- v 

xlirrent Sensors 

Current sensors detect very low current levels using a circuit such as 
shown in Figure 8.3-2. The sensing of very small currents is a corollary of 
operation without loading the circuit being measured. 


The advantages of current sensing include greater reliability than optical 
or light sensing concepts. The result is directly available as a voltage for . 
computer processing and, of course, the signal is continuous and can be used 
to measure a graduated or continuously variable parameter. 

The disadvantage of using a current sensor for display instrumentation is 
that it doesn't really measure the final observable phenomena, whether it is 
the illumination of an indicator light or the displacement of a needle. It 
can only sense the applied current. 


Closed Circuit TV Systems 

jjfe A black and white closed circuit television system can be used to monitor 
various types of display manifestations or observable events. The nature of a 
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ADDITIONAL HARDWARE FOR 



FIGURE 8.3-2 EXAMPLE OF A CURRENT SENSING CIRCUIT 
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horizontal scan line and its. reflection of various image properties is discussed 
subsection 8.4.2. If the direction 'in which the camera is pointed and its 
optical field of view are established accurately, then specific or selected 
lines in the image field can be monitored to detect display phenomena without 
requiring the excessively complex processing associated with pattern recognition 
techniques. This can be accomplished by digitizing a single line or even several 
lines in a manner similar to that described in Section 8.4.2. The identification 
of significant data in the scans then requires processing of 'only a one dimen-, 
sional array of data for each scan. In addition, the area .of the data array 
in which the information is expected to appear is fairly accurately predictable. 

The advantages of a TV scan approach to display monitoring are substantial. 

The TV system can monitor either continuous phenomena or discretes such as indi- 
- cator lights on or off. The TV approach requires virtually no modification of 
the instruments in the crew station. This has the subsidiary advantage of per- 
mitting implementation of the self test system after the crew station or I0S 
is- completely fabricated. 

The disadvantages and problems created by the application of closed circuit 
TV are equally substantial. For one line of the TV image which might be processed 
for each instrument or for an array row of indicator lights, the system described 
in Section 8.4 produces 512 samples. In order to achieve a 1 / 60th second time 
resolution, alternate lines must be sampled and processed, assuming commercial scan 
rates and an- interlaced scan pattern. This approach quickly produces a large 
amount of data for processing if a dynamic test is considered. If a camera is 
used to scan one simple meter, the processing may be minimized. However, this 
makes the cost of the instrumentation exhorbitant. In order to scan more than 
one instrument, the camera field of view can be expanded, reducing the available 
resolution for monitoring each instrument as well as the signal strength of the 
actions being observed. Processing of multiple lines is required if a matrix 
of instruments is considered. However, the instruments on one horizontal scan line 
at a time could be tested and processed before proceeding to another row. Consider- 
ation of the use of a TV system rapidly expands into a design problem that is 
highly sensitive to the particular instrumentation being monitored and its 
— <~onfiguration. 
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Summary ... 

' The above review describes, most of the sensing concepts that were considered 
rur instrumenting one or more of the display devices of interest. The trade offs 
between these approaches and a few others that are uniquely applicable to specific 
displays are reviewed in the analyses of those specific displays starting in 
subsection 8.3.2 . 

8.3.2 Galvanometers 

There are approximately 70 galvanometers in the crew station and 35 in 
the IOS. Various techniques for checking the galvanometers have been examined, 

t 

and one specific approach is recommended. 

8. 3. 2.1 Description and List of Displays Applicable 

The meter has one or two galvanometer movements contained within a round, 
horizontal or vertical rectangular case. The dial face contains a scale that 
is marked in the units and range that are appropriate to the parameter that 
is being displayed on the meter; i.e., 0 to 5000 pounds of oxidizer. If a 
.standard meter does not contain the desired scale, the simulator manufacturer 
^iay make his own scale on a decal and apply it to the meter face. Other alter- 
ations that may be performed by the simulator manufacturer is the addition of 
overload protection with a zener diode, or protection from voltage reversals 
by the addition of a polarity diode. These components seldom fail. The range 
of a meter may be changed by the substitution of shunt or series resistors. 

See Figure 8.3-3 for a typical case design, electrical circuit and equation of 
motion for the 70 meter movements. 

In normal operation all of the parameters affecting motion, except the 
applied voltage, are constants to the simulator engineer. The applied voltage 
(instrument input) will vary according to the variation in the parameter that 
is being displayed; i.e., fuel quantity. The needle movement (instrument 
output) varies according to the ratio of applied voltage to full scale voltage. 
See Table 8.3-1 . 
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fp INPUT 
TERMINALS 


POLARITY 

DIODE 


SCALING 

RESISTOR 



COIL 


Equation of motion 


P JF + ' 


GE 

R 


P = moment of Inertia 

1C * mechanical damping coefficient 

(J = restoring torque constant 

G = the motor constant 

E = the applied voltage 

R s total circuit resistance 


REPRODUCIBILITY OF THE 
OtUfXNAL PADS IS POOR 


FIGURE 8.3-3 TYPICAL GALVANOMETER CASE, CIRCUIT AND EQUATION OF MOTION ' 
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INPUT: 0 to +3 volts ranging up to +100 volts DC 

OUTPUT: needle movement, zero scale to full scale 

ACCURACY: +2 l full scale in crew station 

+3% full scale in IOS 

RELIABILITY: 20,000 hr MTBF 

REFERENCE CONFIGURATION QUANTITY: 58 meter movements 

EXPECTED FAILURE MODES: short circuit 

•open circuit 

no change, or non-linear change in output 
due to evaporated lubricant 
electrical overload may bend needle or 
break a moveable part 

CRITICAL MEASUREMENT POINTS: input terminals 

needle position 


TABLE 8.3-2 FAILURE MODES 


MODE 

SYMPTOMS' _ 

EXTERNAL 

INTERNAL 

OPEN CIRCUIT 

. NO NEEDLE MOVEMENT ' 

NO CONTINUITY 

SHORT CIRCUIT 

NO NEEDLE MOVEMENT 

LOWER THAN USUAL 
. RESISTANCE 

MECHANICAL 

FAILURE 

NO NEEDLE MOVEMENT 
OR NON-LINEAR 
NEEDLE MOVEMENT 

DRIED LUBRICANT OR 
PHYSICAL DAMAGE 

MECHANICAL . 
CALIBRATION 

NEEDLE DOES NOT REST 
AT ZERO WITH 
ZERO VOLTS 

ADJUSTMENT. SCREW ' 
OR LEVER MOVED 

POLARITY 
DIODE 
• FAILURE 

NO NEEDLE' MOVEMENT':- 

NO CONTINUITY : - 

CHANGE IN ELECTRICAL 
CALIBRATION 

CONTINUITY BOTH 
DIRECTIONS * 

ZENER DIODE 
FAILURE 

NO NEEDLE MOVEMENT 

ZERO RESISTANCE 
ACROSS ZENER 

' NONE 

NO CONTINUITY ' 
ACROSS ZENER 
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These principles of operation apply to round, horizontal or vertical 

• faced galvanometers. It is assumed that the correct test voltage will be 
applied to the terminals ofieach meter. This implies that the circuitry 
between the computer and meters have been checked out and calibrated. 

Meters in the flight vehicle are usually illuminated internally, but 
only mission simulator meters are usually so illuminated. 

* i 

\ 

8.3. 2. 2 Failure Modes Analysis and Characteristic Parameters ; 

Table 8.3-2 lists the failure modes and the related symptoms. Potential 
failures are open circuit, short circuit, mechanical failure, mechanical cali- 
bration, polarity diode or zener diode failure. 

It can be concluded from Table 8.3-2 that, in addition to total inoperability, 
galvanometer faults can reveal themselves as calibration errors and as erratic 
movements of the meter. .Detection of the possible faults using only discrete 
sensors at full scale and zero scale positions can be accomplished by assessment 
of the following characteristic parameters assuming an underdamped meter movement 
flhpnd full scale step input function: 

Time to first crossing of 100% value (rise time) 

Time to second crossing of 100% value 
Time to steady state reading (settling time) 

If the meter movement is overdamped, the first two parameters must be 
replaced by a rise time which is typically the time to reach some percent of 
full scale. 

8.3. 2. 3 Hardware Requirements for Galvonometer Self Test 

The alternative means for sensing the galvanometers response to test stimuli 
are summarized in Table 8.3-3. The use of photoelectric sensors is recommended 
on the basis of ease of installation, non-interference with normal meter operation, 
and cost. The choice between simply passive photo transistors and self stimu- 
lating reflective devices,* as summarized in Figure 8.3-1, can and must be made 
during detail design. 
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RELATIVE 

COST 

HARDWARE MODIFICATIONS 

SOFTWARE 

REQUIREMENTS 


CANDIDATE TECHNIQUE 

MODS TO 
INSTRUMENT 

ADDITIONAL MODS 
EQUIPMENT 

REMARKS 

PHOTOELECTRIC SENSORS 
FOR FULL SCALE AND 
ZERO SCALE 

MOD 

INSTALL 2 PHOTO- 
SENSORS ON RE- 
INFORCED SCALE 

LIGHT SOURCE FOR 
ILLUMINATION 
2 DISCRETE 
INPUTS/METER 
POWER SUPPLY ( ? ) 


NO INTERFERENCE WITH NEEDLE 
SELECTED TECHNIQUE 

NEEDLE CONTACT FOR 
CONTINUITY 


INSTALL 2 
CONTACTS 

2 DISCRETE 
INPUTS/METER 

PROCESSING OF 
DISCRETE DATA 

CALIBRATION INTERFERENCE. OVER-RANGE 
NOT DETECTED. 

FLUIDICS SENSING OF 
NEEDLE POSITION 

MOD 

HIGH 

l 

VENT CASE. 
INSTALL 2 
FLUIDIC SENSORS. 

ADD AIR SUPPLY 
SYSTEM 

ADD TRANSDUCERS 
2 DISCRETE 
INPUTS/METER 

TEST CIRCUIT 
CHECK 

EXTRA HARDWARE FOR PNEUMATICS , AND EXTRA 
MAINTENANCE OF PNEUMATIC SYSTEM 

MAGNETIC SENSORS FOR 
FULL SCALE AND 
ZERO SCALE 

MOD 

HIGH 

INSTALL 2 MAG- 
NETIC REED 
RELAYS; 2 MAG- 
NETS OR A 
MAGNETIC NEEDLE. 

2 DISCRETE 
INPUTS/METER 


EXACT POSITION LESS CERTAIN. EXTRA 
WEIGHT ON NEEDLE REQUIRES COUNTER- 
BALANCING, AND STRONGER COIL 

CURRENT SENSORS 

HIGH 

INSTALL AMPLI- 
FIER INSIDE CASE 

POWER SUPPLY ( ? ) 
1 ANALOG 
CHANNEL/METER 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS 

INTERFERENCE DUE TO RADIATED AND CON- 
DUCTED RFI. SIGNAL TO BE SENSED IS 
VERY SMALL. VARIATION IN THE SIGNAL 
IS STILL SMALLER. NEEDLE MOVEMENT 
(OUTPUT) IS UNCERTAIN. 

TV SCAN 

• 

VERY 

HIGH 

■ 

POSSIBLY PAINT 
NEEDLE 

V 

ILLUMINATION 

SOURCE 

TV CAMERA(S) 
CONTROL 
CIRCUITRY 
VIDEO PROCESSING 
HARDWARE 

COMPLEX PROCES- 
SING OF IMAGE 
DATA ARRAYS 

' 

HIGH COST. UNCERTAIN THAT NEEDLE 
DYNAMIC MOVEMENT CAN BE 
ADEQUATELY DETECTED WITH CONVENTIONAL 
SCAN RATES. LARGE DATA PROCESSING 
AND HANDLING REQUIREMENT 


TABLE 8.3-3 CHARACTERISTICS OF. CANDIDATE TECHNIQUES 

r 
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The special hardware requirements for this test are two photosensors and 
^associated circuits per meter movement, a power supply (if different from other 
"simulator hardware), and two bilevel circuits per meter movement. A typical 
circuit for a photosensor is given in Figure 8.3-4. 

To detect needle position, a sensor is placed at the location to be checked. 
When the needle is at the correct position, the sensor circuitry will produce 
a discrete voltage level that will be transmitted via a bilevel line to the 
computer interface. It is desirable to detect the needle position at two points. 
These two points should be at the extreme ends of the scale so that it can be 
verified that the needle has the required freedom of movement, and also to 
verify that the mechanical zero and full scale calibration is correct. 

The full scale sensor should give an ON signal to the computer when, and 
only when, the full scale analog signal is applied. An OFF signal would indicate 
(1) mechanical breakage or failure, (2) meter out of mechanical calibration, 

(3) test circuit failure, or (4) electrical failure. 

The zero scale sensor should give an ON signal to the computer when, and 
'only when, the zero scale analog signal is applied, or if no signal is applied. 

An OFF signal would indicate (1) meter circuit failed ON or PARTLY ON, (2) meter 
out of mechanical calibration, (3) test circuit failure, or (4) mechanical 
failure. 

Figure 8.3-4 shows a typical sensor installation at both extremes of a 
meter. In this case phototransistors are used as the sensors. The circuit 
shown indicates the component arrangement to generate the discrete signal 
required. This arrangement requires one bilevel line for each sensor. Other- 
wise, test circuit failures can give incorrect answers to the computer logic 
system. This design allows the software to determine whether there has been 
a failure in the test circuit, or in the meter circuit. With a suitable software 
program in the simulator computer, the meter, plus the test circuits, can be 
verified very quickly. 


8-93 


MCDOtVfVELL. DOUGLAS ASTRO PJAUTtCS COMPANY » EAST 



MDC El 150 
1 November 1974 


PHOTOSENSOR' IN TO-18 CASE 



FIGURE 8.3-4 SAMPLE PHOTOCELL LAYOUT AND CIRCUIT 
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Signal line requirements for a simulator with 70 meter movements , using 

'~a two position measurement, would require an additional 140 bilevel input 
lines to the computer. Switching of bilevel lines that are normally dedicated 
to the simulation will be considered but the cost of dedicated test circuit 
discrete inputs will: be weighed against the cost and reliability of the . 
switching network. 

8. 3. 2. 4 Software Requirements and Data Base Impact 

A software flow for checkout of an array -of galvanometers is shown in 
Figure 8.3-5. This software flow assumes that the complete array of meters 
can be tested with the loops for sampling the meter sensors having a short 
enough time to provide adequate resolution time wise. If the software is executed 
in a slow computer or if other ‘considerations prevent this possibility, then the 
full complement of meters will need to be subdivided into smaller arrays. This 
does not impact the basic concepts shown in the software flow. 

. The time reference for the data is obtained from an external clock which 

^■hould be sampled every time the data on sensors is sampled. This assures a 

\ / 

'positive and accurate time reference for each sampling. There is no requirement 
for this particular test for the data samples to be at equal time intervals. 
Consequently, there is no provision for monitoring the clock for this purpose. 

The input data which must be loaded from the data base consists entirely of 
characteristic time information.- These arrays may be summarized as follows: 
e Rise time 

• Rise time tolerance . 

e Rise time marginal performance levels 

e Second crossing time 

e Second crossing time tolerance 

e Second crossing marginal performance levels 

e Settling time 

e Settling time tolerance 

e Settling time marginal performance levels 
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/ INITIALIZE 
\ DATA ARRAYS 



INITIAL SOFTVfARE LOAD INCLUDES, AS 
INPUTS, ALL REFERENCE DATA FOR- EACH 
•METER* 

(1) REFERENCE PERFORMANCE LEVELS FOR 
CHARACTERISTIC PARAMETERS 
e RISE TINE - RTREF{N) 

« SECOND CROSS TIME - SCTREF(N) 
e SETTLING TIME - SETREF(N) 

(Z) ABSOLUTE TOLERANCES 
• RISE TIME - RTTOL(N) 

■ « SECOND CROSS TIME - SCTTOL(N) 

6 SETTLING TIME - STETQL(N) 
INCIPIENT FAULT DETECTION CRITERIA 
« RISE TIME - RTIFD(N) 
c SECOND CROSS TIME - SCTIFD(N) 
e SETTLING TIME - STEIFD(N) 


ALL TIME STORAGE ARRAYS AND ' 
METER NUMBER ARRAYS MUST BE 
INITIALIZED TO ZERO. 

(RT(N) = SCT(M) = SET(N) = 0 
RTE(N) = SCTE(N) = STE(,N) = 0 


METERS WITH CALIBRATION ERROR 
OR FAULTY ZERO SCALE SENSOR 


METERS WITH FAULTY FULL 
SCALE SENSORS 


5SP?.0DDCiBILrrY OF T:D3 
< \Xj PAQ-i; 10 12 jA . 
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' FIGURE 8.3-5 GALVANOMETER TEST SOFTWARE (continued) 



i-*ar& exn) psx-d 

V 


BEGIN TEST 
*— 1 DATA PROCESSING 


i, CREATE ARRAY 
OF l!ETER NOS. 

WITH ZERO RISE TIMES 
RT(H) = 0 




flETERS WITH 8AD 
FULL SCALE SENSORS 
OR UNDEFINED FAULTS 
BECAUSE THEY NEVER 
REACHED FULL SCALE 


DO FOR EACH METER "H" 


CREATE ARRAY 
OF METER NOS. 

WITH ZERO 
SECOND CROSSINGS 
OR SETTLING TIMES 


1 



f METERS l 
1 CALI BRA" 


WITH 

CALIBRATION ERRORS 




COMPUTE OYNA M .IC ERRORS 

RISE TUT ERRPR: 

RTE(H) = RT(!0-RTREF(M} 
SECOND CROSS TIME ERRORS: 

. SCTE(H) = SCT(N)'SCTREF(N) 
SETTLING TIME ERROR: 

" STE(») = SET(tl)-SETREF(M) 



ESTABLISH LIST O c 
METERS WITH UNACCEPTABLE 
DYNAMIC PERFOPJ'AMCE 


INCIPIENT FAULTS IOENTIFIS 
ON THE BASIS OF "ARGINAL 
PERFORMANCE (GRAY AREA). 


PRIMARY OUTPUT IS THE 
IDENTIFICATION NUMBERS OF 
METERS IN THE VARIOUS 
PERFORMANCE CATEGORIES. 
ACTUAL PERFORMANCE DATA 
MAY BE OUTPUT AS REQUIRED 
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The galvanometers in the IOS are likely to be duplicates of the meters 
In the crew station and would not require unique reference data. Likewise, * 
many of the meters in the crew station are likely to have similar movements 
.arid not require unique data. Overlooking the latter aspect because convenience 
or configuration management aspects may make it desirable to have complete 
reference arrays, the storage of the above parameters would require 630 floating 
point words for a total of 70 galvanometers. 

The number of instructions required for the test software can be expected 
to be fairly small; 300 instructions is probably conservative. 

The results or outputs of the test are the status of the various meters 
by meter number, that is, the meter numbers of meters with undetermined faults; - 
of meters with calibration errors; of meters with failed s.ensors, etc. In 
addition, the rise times or other parameters which may be of potential interest 
for foil ow-up' action can also be. 'd-i-s played or printed as desired-. 


8-99 


MCDOMKJEU.L. DOUGLAS ASTFtOPJAlJTICS COMRUW V - EAST 



MDC Ell 50 
1 November 1974 

.3.3 DC Servo Driven Meters 

This section describes ^various techniques of checking tape meters and 

"normal 11 meters that have DC analog servo drives. There are approximately 

36 meter movements that use a servo drive technique in the crew station. One 

technique is recommended as the best choice for accuracy, simplicity and 

flexibility. • : 

\ 

- t 

8. 3. 3.1 Description and List of Displays Applicable 

The servo meter movement contains a DC analog servo system that moves a 
needle or pointer through an arc of 120 to 360 degrees full scale. The dial 
face contains a scale that is marked in the units and range that are appropriate 
to the parameter that is being displayed on the meter; e. g., Gs of acceleration. 
See Figures 8.3-6 and 8.3-7 for a typical case design and electrical circuit. 
Additional description is given in Table 8.3-4. The specific meters that are 
expected to have DC servo drives are the Attitude Director Indicator (error 
and, rate needles) and the Normal /Longitudinal Accelerometer Indicator. 

In normal operation, the DC signal from the computer goes through a summing 
amplifier together with a feedback signal from the position potentiometer. This 
summed signal goes to a torque motor which drives the needle and position poten- 
tiometer. See Figure 8.3-8. Some simulator instruments convert 26VAC, 400 hertz 
to supply DC power to the motor and regulated +10 VDC and -10 VDC to. the position 
potentiometer and amplifier/ 

Tape meter movements contain a DC analog servo system that moves a tape 
past a window and a pointer. See Figure 8.3-9. The tape contains an extra 
long scale that is too long to be placed on the face of a servo -meter of the 
same package size. Another version of the meter uses the tape as the pointer 
(with contrasting color areas) for display against a fixed scale. Additional 
description is given in Table 8.3-5. 

In normal operation, the DC signal from the computer goes through a summing 
amplifier together with a feedback signal from the position potentiometer. This • 
^.summed signal goes through a second summing amplifier together with a feedback 
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FIGURE 8.3-6 


T MAX- 


MALWIN ELECTRONICS CORP 
MODEL 1376-0 
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CONNECTOR 



TYPICAL SERVO DRIVEN INSTRUMENT' 
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TABLE 8.3-4 DC SERVO DRIVEN METERS 

I 

INPUT: 26 VAC, 400 HZ (power) 

-10 to +10 volts DC (signal) 

OUTPUT: Needle movement, zero scale to full .scale 

ACCURACY: +2% full scale 

RELIABILITY: 7,500 hV MTBF 

REFERENCE CONFIGURATION QUANTITY: 16 meter movements 

EXPECTED FAILURE MODES: short circuit in internal connections 

open circuit in internal connections 
no movement,' or non-linear movement due to evaporated 
lubricant, or degraded amplifier 

/ .. electrical overload may bend or break mechanical parts(s) 

‘ . ; •• failure of internal electrical or mechanical components 

CRITICAL -MEASUREMENT POINTS: input terminals . ' 

needle position 
’ position feedback signal 


FIGURE 8.3-8 DC SERVO DRIVEN METER 


O 
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FIGURE 8.3-9 TAPE METER CONSTRUCTION 
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TABLE 8.3-5 TAPE METERS 


INPUT: 0 to +10 volts DC 

OUTPUT: Tape movement, zero scale to full scale 
ACCURACY: +2% full scale 

RELIABILITY: 3,000 hr MTBF 

REFERENCE CONFIGURATION QUANTITY: 20 meter movements 

EXPECTED FAILURE MODES: short circuit 

open circuit 

no change, or non-linear change in output due to 
evaporated lubricant, or degraded amplifier 
electrical overload may bend or break mechanical part(s) 

CRITICAL MEASUREMENT POINTS: input terminals 

tape position/position feedback signal 


FIGURE 8.3-10 TAPE METER ANALOG SERVO SYSTEM MODIFIED FOR AUTOMATIC CHECKOUT 



ssessws' 
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( signal from the tachometer. The resulting output goes to- a torque motor which 
drives the tape sprocket, tachometer- and position potentiometer. See Figure 
8.3-10. ‘Specific meters that are expected to have tape drives are the Air 
Speed/Mach Indicator, and A1 timeter/Vertical Velocity Indicator. 


The following analysis assumes that the correct voltage will be applied, 
to the connector pi-ns-, and that the internal voltage regulator and power 
supplies have been checked and calibrated as a result of previously performed 
checkout and calibration on the rest of the simulator equipment. 


8. 3. 3.2 Failure Mode Analysis and Characteristic- Parameters 

The failure modes of servo meters and tape meters are summarized in 
Tables 8.3-6 and 8.3-7, respectively. Since these devices are both basic 
servomechanisms, the normal performance criteria for simple control systems 
are applicable. In this instance, the evaluation of the meters response to 
a step input should be sufficient to identify the failures noted in the table. 
In- 'each case, the characteristic parameters, may be taken to ; be the- following:- 

© Rise time 
© Percent overshoot 
© Settling time 

© The time of peak overshoot may also be useful 
© Static calibration check points 


( \ 

Hardware requirements V.J data acquisition, as well as software requirements 
are summarized below. 


8.3. 3. 3 Self Test Hardware Requirements 

Automatic checkout or self-test of DC servo driven meters or tape meters, 
in general, requires a means for sensing needle/tape movement in response to 
voltage input, and the generation of an electrical response signal indicative 
of needle/ tape position, which can be communicated back to a computer for 
processing. The various techniques for sensing needle/tape position enable 
detection of discrete points of needle/tape position, such as full scale and 
zero scale or selected intermediate points, or the continuous monitoring of 
fcneedle/tape position. 
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MODE 

Symptoms ! 

EXTERNAL 


OPEN CIRCUIT 

NO NEEDLE MOVEMENT 

NO CONTINUITY 

SHORT CIRCUIT 

NO NEEDLE MOVEMENT 

LOWER THAN USUAL 
RESISTANCE 

MECHANICAL 

FAILURE 

NO NEEDLE MOVEMENT OR 
NON-LINEAR NEEDLE 
MOVEMENT 

DRIED LUBRICANT DR- 
PHYSICAL DAMAGE 

400 HZ POWER SUPPLY 
OR TRANSFORMER 
FAILURE 

NO NEEDLE MOVEMENT 

OPEN/SHORTED TBANSFQRMEF 
WINDING, NO DC OUTPUT 
FROM POWER SUPPLY 

FAILURE OF REGULATOR 
FOR REFERENCE 
VOLTAGE 

NO NEEDLE MOVEMENT. 
INACCURATE NEEDLE 
MOVEMENT 

NO POWER TO AMPLIFIER, 
DRIVER, MOTOR, FEEDBACK 
POTENTIOMETER. DRIFT 

KOTOR 

NO NEEDLE MOVEMENT 

OPEN/SHORTED WINDING 



BOUND BEARINGS 
BERT SHAFT 

SIGNAL AMPLIFIER, 

NO NEEDLE MOVEMENT 

OPEN CIRCUIT 

DRIVER 

INCORRECT NEEDLE 
MOVEMENT 

NON-LINEAR VOLTAGE 
OUTPUT 

POSITION 

POTENTIOMETER 

' NEEDLE QUICKLY DRIVEN 
OFF SCALE 

OPEN WIPER, COIL OR 
SERIES RESISTOR 


NEEDLE OPERATES ON 
HALF OF. SCALE ONLY, 
DRIVEN AGAINST HARD- 
STOP 

ONE VOLTAGE MISSING ON 
COIL 

CALIBRATION 

POTENTIOMETER 

STEP SHIFT IN NEEDLE 
POSITION: CALIBRATION 
REQUIRED 

OPEN CIRCUIT IN 
BYPASS LINE 


NO NEEDLE MOVEMENT 

OPEN COIL OR SERIES 
RESISTOR. 


4* A 


MODE 

SYMPTOMS 1 


iHMMuiaaMMi 

OPEN CIRCUIT 

NO TAPE MOVEMENT 

NO CONTINUITY 

SHORT CIRCUIT 

NO TAPE MOVEMENT 

LOWER" Tii AN"USUAL 
RESISTANCE 

MECHANICAL 

FAILURE 

NO TAPE MOVEMENT OR 
NON-LINEAR TAPE 
MOVEMENT 

DRIED LUBRICANT OR 
PHYSICAL DAMAGE 

DEGRADED 

AMPLIFIER 

NON-LINEAR TAPE 
MOVEMENT 

NON-LINEAR 
VOLTAGE OUTPUT 

MOTOR 

NO/JERKY TAPE 
MOVEMENT 

OPEN/SHORTED WINDING. 
BOUND BEARINGS. 

BENT SHAFT. 

POSITION POT 

TAPE DRIVEN TO 
EXTREME ENDS ONLY 

OPEN WIPER OR COIL 

TACHOMETER 

OVER/UNDER SPEED OF 
TAPE, JERKY MOVEMENT 
OF TAPE 

NO/LOW OUTPUT VOLTAGE. 
BROKEN SHAFT OR GEAR 
TOOTH. SLIPPING GEAR. 

TAPE 

NO TAPE MOVEMENT 

TAPE OFF SPROCKET 
TEETH OR SLIPPED A ' 
TOOTH. BROKEN TAPE. 


TABLE 8.3-7 FAILURE MODES OF TAPE METERS 


TABLE 8.3-6 FAILURE MODES OF SERVO METERS 
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Candidate techniques applicable to the DC servo driven meters are summarized 
|n Table 8.3-8. ; 

It is recommended that the built-in position feedback signal be utilized' 

to send a position signal to the computer during checkout. This should be a 
* 

minimum cost modification for addition of a buffer amplifier and afford excellent; 
resolution and minimal software requirements . _ See Tables 8.3-8 and 8.3-9 for a 
summary of characteristics of the discussed techniques. 

The wiper on the position potentiometer and the needle/tape are mechani- • 
caTl.y connected so that both move according to a specific ratio. According 
to Figures 8.3-7 and 8.3-9, the position potentiometer feeds an analog sig- 
nal to a summing amplifier in proportion to the needle/tape movement. If 
this signal is also routed to an analog-to-digital channel for needle/tape 
position processing by the computer, the basic checkout criteria are met. 

To prevent impedance mis-matching at the summing amplifier, a buffer ampli- 
fier would be used in the analog-to-digital line to the computer. The eom- 
^gpter software can "rectify" any undesired signal inversion that may take place. 

The use of the feedback signal from the position pot enables dynamic- 
testing of these meters with a continuous position signal available for computer 
processing. If experience with a specific meter should establish calibration 
to be a major or frequent problem, calibration checks can be implemented using . 
the phototransistors as discrete position sensors as proposed for the galvanometers. 

* 

'8. 3. 3. 4 Self Test Software and Data Base Impact 

The software flow diagram for the self test software for the servo driven . 
needle and tape meters is shown in Figure 8.3-11. The software takes advantage - 
of a .standard dynamic test module defined and described in Section 7. 1.1. 3 . 

The meter test software consists of the limited number of operations required to 
initialize the test software and identify the arrays for all required input 
data for the test module as well as the arrays to store results. 
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RELATIVE 

r HARDWARE MODIFICATIONS 

WtSBM 


CANDIDATE TECHNIQUE . 

COST 

MODS 10 
INSTRUMENT 

ADDITIONAL MODS 
EQUIPMENT 

REMARKS 

PHOTOELECTRIC SENSORS 
FOR FULL SCALE AND 
ZERO SCALE 

MOD 

INSTALL 2 PHOTO- 
SENSORS. PUNCH 
2 HOLES IN TAPE. 

LIGHT SOURCE FOR 
ILLUMINATION 
2 DISCRETE 
INPUTS/METER 
POWER SUPPLY ( ? ) 


WINDOW OPENINGS VERY SMALL. 
TAPE STRENGTH DEGRADED. 

SPECIAL CONTACT AREA 
ON TAPE 


INSTALL 2 CON- 
TACT SURFACES 
AND BRUSHES-^ 

2 DISCRETE 
INPUTS/METER 

PROCESSING OF 
DISCRETE DATA 

SHORT TAPE LIFE. 

FLUIDICS SENSING OF 
TAPE POSITION 


VENT CASE> 
INSTALL 2 
FLUIDIC SENSORS. 
ADD HOLES TO 
TAPE. 

ADD AIR SUPPLY 
SYSTEM 

ADD TRANSDUCERS 
2 DISCRETE 
■ INPUTS/METER. 

TEST CIRCUIT 

checked; 

EXTRA HARDWARE FOR PNEUMATICS, AND 
EXTRA MAINTENANCE OF PNEUMATIC SYSTEM. 

MAGNETIC SENSORS ON 
TAPE FOR FULL SCALE 
AND ZERO SCALE 


INSTALL 2 
MAGNETIC REED 
RELAYS. 2 MAG- 
NETS ON TAPE. 

2 DISCRETE 
INPUTS/METER 


EXACT POSITION LESS CERTAIN. 
DIFFICULTY WITH MAGNET GOING AROUND 
SPROCKET. 

FEEDBACK FROM POSITION 
POTENTIOMETER 

LOW 

INSTALL AMPLI- 
FIER INSIDE 
CASE. TAP 
FEEDBACK SIGNAL 

1 ANALOG 
CHANNEL/METER 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS. 

POSITION SIGNAL EXISTS. 

TV SCAN 

1 

POSSIBLY PAINT 
TAPE 

ILLUMINATION 

SOURCE 

TV CAMERA(S) 
CONTROL 
CIRCUITRY 
VIDEO PROCESSING 
HARDWARE 

COMPLEX PROCES- 
SING OF IMAGE 
DATA 

HIGH COST. UNCERTAIN THAT TAPE (SMALL 
AREA) MOVEMENT CAN BE ADEQUATELY 
DETECTED. 


TABLE 8.3-8 CHARACTERISTICS OF CANDIDATE TECHNIQUES FOR TAPE METERS 


MDC- El 150 
1 November 1974 



















s.sv3 - /i/utawoa so/jt/jwvo«jtsp r svtoooo Tt3t\//voaatv 


\ 



RELATIVE 

COST 

■ — HARDWMnwrncArrMs 

SOFTWARE 

REQUIREMENTS 

REMARKS ’ | 

CANDIDATE TECHNIQUE 

MODS TO 
INSTRUMENT 

ADDITIONAL 'MODS 
EQUIPMENT- 

PHOTOELECTRIC SENSORS 
FOR FULL SCALE AND 
ZERO SCALE 

MODERATE 

INSTALL 2 PHOTO- 
SENSORS ON RE'IN- 
rORCED SCALE 

LIGHT SOURCE FOR 
ILLUMINATION 
2 DISCRETE 
INPUTS/METER 
POWER SUPPLY!?) 


NO interference with needle 

.... . - - r - 

NEEDLE CONTACT FOR 
CONTINUITY 


INSTALL 2 
CONTACTS 

2 DISCRETE 
INPUTS/METER 

PROCESSING OF 
DISCRETE DATA 

CALIBRATION INTERFERENCE. OVER-RANGE NOT 
DETECTED. 

FLUIDICS SENSING OF 
NEEDLE POSITION 

MOD 

HIGH 

VENT CASE. 
INSTALL 2 
VLUIDIC SENSORS. 

\ 

POWER SUPPLY(?) 
ADD AIR SUPPLY 
SYSTLM 

ADD TRANSDUCERS 
2 DISCRETE 
INPUTS/METER 

TEST CIRCUIT 
CHECKED. 

EXTRA HARDWARE FOR PNEUMATICS, AND EXTRA 
MAINTENANCE OF PNEUMATIC SYSTEM. 

TV SCAN 

VERY 

HIGH 

POSSIBLY PAINT 
NEEDLE 

\ ' 

ILLUMINATION 

SOURCE 

TV CAMERA! S) . 
CONTROL 
CIRCUITRY 
VIDEO PROCESSING 
HARDWARE 

COMPLEX ' 
PROCESSING OF 
IMAGE DATA 

HIGH COST. UNCERTAIN THAT NEEDLE (SMALL ' 
AREA) MOVEMENT CAN BE ADEQUATELY , 
DETECTED. 

_ 

FEEDBACK SIGNAL 
FROM POSITION 
POTENTIOMETER 

LOW 

ADD BUFFER ' 
AMPLIFIER. TAP 
FEEDBACK SIGNAL 

ONE ANALOG 
CHANNEL PER 
METER- 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS 

NO INTERFERENCE WITH NEEDLE. LOWEST COST. 
MOST VERSATILE IN SOFTWARE MODIFICATIONS. 
POSITION SIGNAL EXISTS. 

SNAP ACTION SWITCHES 

MODERATE 

INSTALL 2 LONG 
LCVER SNAP 
ACTION SWITCHES 

2 DISCRETE ’ 
INPUTS/METER 

PROCESSING OF 
DISCRETE DATA 
TEST CIRCUIT 
CHECKED 

LOOSE TOLERANCE ON REPEATABILITY GIVES 
POOR TEST RESULTS. LOW FORCE REQUIREMENTS 
FROM NEEDLE. 


TABLE 8.3-9 CHARACTERISTICS OF CANDIDATE TECHNIQUES FOR SERVO METERS 
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SERTST 


LOAD REFERENCE 
DATA FOR 
TEST 


CALL 5TR5P 
(TRANSIENT 
RESPONSE 


FOLLOWING DATA ARE 
TEST INPUTS: 
o NUK3ER OF METERS 
o TEST STEP AMPLITUDE 
o NOMINAL VALUES 
0 TOLERANCES 
o MARGINAL (GRAY AREA 
PERFORMANCE LEVELS) 
o OUTPUT ARRAY NAMES 


X are \ 

RISE TIME v 
PEAK OVERSHOOT AND 
SETTLING TIME 
WITHIN TOLERANCE . 


/ IS \ 

^ RISE TIME \ 

PEAK OVERSHOOT OR 

SETTLING TIME 

MARGINAL 


STukE NtiER 
HO. & DATA IN 
OUTPUT BUFFER, 
SET FLAGS 


/store meter 
[NO. & INCIPIENT! 
‘ FAULT DATA IN 
OUTPUT BUFFER. 
SET FLAGS 


JEST DATA OUTPUTS- FOR 
FAILED METERS OR 
METERS WITH INCIPIENT 
FAILURES INCLUDES FOLLOWING: 
o METER NUMBER 
o RISE TIME 
o PEAK OVERSHOOT 
o SETTLING TIME 


ARE 

ALL METERS 
OK 
■> 


SET FLAG 
FOR SERVO 
METERS OK , 
MESSAGE / 


RETURN 


FIGURE 8.3-11 SERVO METER SELF TEST SOFTWARE FLOW, SERTST 


8-111 


n/rcoorvfUEi-L. douglas s\s>moru Aij~riGS company - east 


MDC £1150 
1 November 1974 


The reference data arrays requiring data base storage consist of the 
following: j 

e Step input test signal amplitude or scale factors 
o Rise time nominal values 

© Rise time tolerances for absolute failure 

• © Rise time tolerances for gray area performance (incipient' faul ts) 

© Peak overshoot nominal values- 

e Peak overshoot tolerances for unacceptable performance 

© Peak overshoot tolerances for incipient fault detection 

e Settling time nominal values 
©; Settling time tolerances for absolute failure 

© Settling time tolerances for incipient fault detection 

The total data base impact for 36 meters in the crew stations is 9 X 36 
or 324 floating point parameters. Instruction requirements peculiar to the 
meter test are insignificant. The dynamic test module is counted as a library 
routine. If phototransistors are added for calibration checks, the data base 
‘js not impacted significantly. The parameters- acquired for that purpose are 
'--js'lmply discretes. 
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8 . 3.4 Synchro/Resol ver Driven Meters 

The Attitude Director Indicator (ADI) contains a resolver driven attitude 
fall and six servometer pointer movements. The Horizontal Situation Indicator 
is similar to the DC servo driven meters except for the TO/FROM Indicator, DME 
readouts. Heading Select Bug, and Selected Course Pointer. The crew station 
contains two each of these instruments and the IOS contains two each for a 
total of four ADI 1 s in the simulator. 

8. 3. 4.1 Description and List of Displays Applicable 

The Attitude Director Indicator has an attitude ball and six servometer 
pointer movements: three for rate indications and three for error indications. 

Figure 8.3-12 depicts the face of the ADI. . One rate pointer and one error 
pointer are provided for each spacecraft axis: pitch, yaw and roll. The 

pointer is basically a motor driven pointer with a shaft extension that 
comprises the wiper of a position feedback potentiometer that is connected 
to +15VDC and -15VDC. See figure 8.3-13. This feedback voltage is fed as 
an error signal into an amplifier which drives the motor. 

The attitude ball is a hollow sphere which is capable of continuous 
_Jt>tation in three axes to indicate the pitch, yaw and roll attitude of the 
spacecraft. Each axis is controlled by a 4-wire. (sine/cosine) input network. 

Each axis also has a motor, a rate generator, and a resolver position feedback 
which operate from 400 hertz input. See Figure 8,3-14. When the ball is at 
the commanded position, the resolver feedback signal is at a null, (minimum 
AC voltage output). The resolver feedback signal is fed into the amplifier 
which drives the motor. 

The ADI, as used on a simulator, is normally a flight type instrument 
that has not been tested for airworthiness. It is usually sealed air tight, 
and may contain an inert gas. For more detailed mechanical' Information on a 
typical ADI, see the' top assembly drawing, DJG264E, for the Apollo Flight 

9 

Director Attitude Indicator (FDAI) produced by Honeywell, Inc., Military 
Products Group. 

During the first five years, of the Apollo and Skylab program, there were 
essentially no failures of the ADI. The only problems that developed were the 
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POINTER 


NEEDLE 



POINTER 

FIGURE 8.3-12 FACE OF ATTITUDE DIRECTOR INDICATOR 



REPRODUCIBILITY 0? THE 

FIGURE 8.3-13 TYPICAL RATE/ERROR Crfcf S F00R 
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FIGURE 8.3-14 TYPICAL CIRCUIT OF ONE AXIS OF ATTITUDE BALL 


MDC El 1 50- 
1 November 1974 



MDC Ell 50 

• 1 November 1974 

gradual degradation of the electroluminescent lighting and the cleaning and 
oiling of bearings. A few other problems developed during the next two years, 
feee Table 8.3-10. 

The Horizontal Situation Indicator (HSI) contains several components that 
display navigation information. The information displayed is: miles from a 

TACAN station (2 displays), magnetic heading, heading selected, course sel- 
ected, angular deviation from course, whether approaching or leaving selected 
TACAN station, and angular position relative to the selected glideslope. A 
picture of the instrument is shown in Figure 8.3-15. 

* 

The components which display this information are listed in Table 8;3-ll. 
Component description is also given in Table 8.3-11, and sample schematics 
are shown in Figures 8.3-16, -17, -18, and -19. 

The analysis that follows assumes that the correct test voltages are 
applied to the connector pins of the instrument. This implies that the 
circuitry between the computer and the instrument has been checked out and 
'’’"'.calibrated. 

I 1 

, S/ rf 

8. 3. 4. 2 Failure Modes and Characteristic Parameters 

The failure modes of the ADI and the HSI respectively are summarized in 
Tables 8.3-12 and 8.3-13 respectively. 

The characteristic parameters for composite instruments of this type 
must necessarily be the characteristic parameters nominally used for 
assessing the performance of each of the basic type of instrument components. 

The characteristic parameters required for the ADI consist of the 
following: 
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TABLE 8.3-10 ATTITUDE. DIRECTOR INDICATOR 

INPUTS: 'Motor control signal for each of 3 axis 
4 wire sin/cos signal for each of 3 axes 
400hz power 

6 DC signals for pointers 
+15VDC reference voltage 

OUTPUTS: Movement of six pointers 

.Attitude ball position in 3 axes 

3 pairs of 400fiz 2 wire resolver feedback/position signal for ball position 
-15VDC to +15DC position feedback signals for each of 6 pointers 

RELIABILITY: 7,000 hr MTBF 

QUANTITY: 2 in crew station 

2 in instr. /operator station 

^EXPECTED FAILURE MODES: 

Short Circuit 
Open Circuit 

No change, or non-linear change in output due to dirt or evaporated 
lubricant (if instrument is not properly sealed) 

Electrical overload may bend or break a moveable part- 

CRITICAL MEASUREMENT POINTS: input and output terminals 

pointer position 
ball position 
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FIGURE 8.3-15 HORIZONTAL SITUATION INDICATOR- 


IUFORMATIOn 

tii'jtAau 

COMPONENT 
COMMON HAUL 

.INPUT 

uuipur , 

lire or* 
DEVICE 

REMARKS' 

1 . HUES FROM TACAH 

DISTANCE MEASURING 
EQUIPMENT (DME) 

DIGITAL DC 

ILLUMINATION OF SEG- 
MENTS OF 7 ELEMENT 
DIGITS 

7-ELEMENT REACOUT. . 
4 DIGITS/H1NDOH. 

2 WINDOWS 

ALTERNATE METHODS: 
DESIGN IS NOT FROZEN 

ANALOG DC 

ODOMETER MOVEMENT 

SERVO CONTROLLED 
ODOMETER 

■ 2 . MAGNETIC 
HEADING 

COMPASS CARO AND 
LIBBER LINE 

ANALOG DC 

COMPASS "CARD" ROTATION 
LUBBER LIME IS FIXED. 

SERVO 


3. HEADING 
SELECTED 

’ HEA01NG SELEf S 

I 

HEADING 
SELECT KNOB 

ANALOG DC 

GEAR TRAIN' AND 
POTENTIOMETER 

4 . COURSE 
SELECTED 

SELECTED COURSE 
POINTER 

COURSE 
SELECT KNOB 

ANALOG DC 

GEAR TRAIN AND 
POTENTIOMETER 

DEVIATION BAR AND "TAlU 
OF POINTER, ALSO "DOTS" 
AND TO/ FROM INDICATOR 
ROTATE WITH POINTER 
MOVEMENT. 

S. ANGULAR DEVIA- 
TION FROM COURSE 

VOR AND LOCALIZER 
DEVIATION GAR 

ANALOG DC 

MOVEMENT OF DEVIATION 
BAR 

GALVANOMETER* 

* 

6. APPPOACHIHG/ 
LEAVING TACAH 
STATION 

TO/FROM INDICATOR 

DIGITAL DC 

SEESAW MOVEMENT OF 
POINTER 

SOLENOID 

7. ANGULAR POSITION 
RELATIVE TO 
GLIDE SLOPE 

Gt I DESLOPE POINTER 
' 

ANALOG DC 

WVEHENT OF GLIDESLOPE 
POINTER 

GALVANOMETER* 


* KING RADIO COR?. MODEL KI525, PICTORIAL NAVIGATION INDICATOR. SHUTTLE INSTRUMENT IS EXPECTED TO BE SERVO DRIVEN. 
QUANTITY: 2 IN CREW STATION, 2 IN INSTRUCTOR-OPERATOR STATION, FLIGHT INSTRUMENT, MODIFIED TO ACCEPT DC INPUTS. 
RELIABILITY*. NO DATA AVAILABLE. 


EXPECTED FAILURE MODES: SHORT CIRCUIT 

OPEN CIRCUIT 

BREAKAGE OR SEPARATION OF PARTS FROM VIBRATION/SHOCK. 
ELECTRICAL OVERLOAD HAY BEND OR BREAK A MOVEABLE PART. 

KOH-HOYIHG COMPONENTS: LUBBER LINE 

SYMBOLIC AIRCRAFT 

CRITICAL MEASUREMENT POINTS: INPUT AND OUTPUT TERMINALS 

POINTER/INDICATOR POSITIONS 


^.Z,?£OL' ? JCLBil.!TY Oi!‘ -* YeL ' 
OEICsiYAL, FAGS IB ?CCE 


TABLE 8.3-11 FUNCTIONAL DESCRIPTION OF HSI ELEMENTS 
* 8« l ] 8 
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FIGURE 8.3-16 DC ANALOG SERVO SYSTEM AS USED FOR GLIDESLOPE, 
DEVIATION BAR, AND COMPASS CARD 



FIGURE 8.3-17 SOLENOID OPERATED TO/FROM INDICATOR 
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OTHER 
LOADS 
(REF) f 


Rstd = I 

> STANDARD ' 
> RESISTANCE * 
>0F SEVEN 
> ELEMENT 
>DIGIT (OR 
l LED SEG- 
MENTS) 

• COMPUTER 
. CONTROLLED! 
\COftTACTS 


FIRST 

SEVEN 

ELEMENT 

DIGIT 


ADD FOR — 
CHECKOUT 


4 BIT BCD 
SIGNAL FROM 
COMPUTER 



. BCD TO 


BCD TO 

7 -ELEMENT 


7 -ELEMENT 

DECODE CHIP 


DECODE CHIP 


4 BIT BCD 
SIGNAL FROM 
COMPUTER 


FIGURE 8.3-18. .TECHNIQUE FOR MEASURING CURRENT THROUGH DME 
SEVEN-ELEMENT DIGITAL READOUT ASSEMBLIES 



output signal 

TO AUTOPILOT 


OUTPUT SIGNAL 



CARO 

POTENTIOMETER 


FIGURE 8.3-19 HEADING SELECT AND COURSE SELECT ELECTRICAL DIAGRAM 
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Component 

‘Attitude ball (servo driven) 


Pointers (Galvanometers) 


The characteristic parameters for the 
servo driven and galvanometer movements as 
additional types of components noted: 
Component 

DME (7 element digital readout) 
To/From Indicator (Solenoid) 


muc 1 1 rou 
1 November 1974 
Characteristic Parameters 
* Static position calibration parameters 
Dynamic response on each axis 
Rise time 
Peak overshoot 
Settling time 

Critical tolerances and marginal 
tolerances for the above 
parameters 

Static position checks 
Rise time \ • 

i , 

w 

Settling time . 

Tolerances on the above 

HSI must include the above for the 
well as the following for the 

Characteristic Parameters 
Discrete status for each element. 
Discrete status (two position) 


The remaining functions of the HSI are either servo driven or 
galvanometers. 


The combination of ca ^'"'ration check points* dynamic response for the 
continuously varying devicewnd condition checks for the discreter or bilevel 
devices should be sufficient to reveal any of .the types of malfunctions noted 
in the Tables 8,3-12 and 8.3-13. 

i 

8. 3. 4. 3 Self Test Hardware Requirements 

Automated checkout or self-test of pointer or ball instruments, in general, 

requires a means for sensing instrument movement in response to a voltage input, 
and the generation of an electrical response signal indicative of instrument 
position, which- can be communicated back to a computer for processing. In the 
case of readouts which are composed of glowing numbers or segments of numbers. 
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MODE 

By Failure of Component 

SYMPTOMS 

EXTERNAL 

INTERNAL 

POINTER SERVO MOTOR 

NO POINTER MOVEMENT ' 

OPEN/SHORTED WINDING, WIPER 

ERRATIC POINTER' MOVEMENT"' ~ “ 

BOUND BEARINGS , BENT SHAFT - ”" 

POSITION POTENTIOMETER 

POINTER DRIVEN TO EXTREME ENDS 
QUICKLY. 

OPEN WIPER OR COIL • " 

POINTER OPERATES ON HALF OF SCALE 
ONLY, DRIVEN AGAINST HARDSTOP 

ONE VOLTAGE MISSING ON COIL 

TACHOMETER 

OVER/UNDER SPEED OF BALL, JERKY 
MOVEMENT OF BALL 

NO/LOW OUTPUT VOLTAGE, SLIPPING 
GEAR, OPEN/SHORTED WINDING IN 
400HZ or V G COIL 

ATTITUDE BALL 
RESOLVER MOTOR 

NO/JERKY BALL MOVEMENT 

BOUND BEARINGS, OPEN/SHORTED 
SECTION OF WINDING 

RESOLVER NETWORK 

BALL STOPS IN WRONG POSITION 

OPEN/SHORTED WINDING OF ONE 
STATOR OR ONE ROTOR 

NO BALL MOVEMENT 

"O'PEN/ SHORTED BOTH 400 HERTZ 
STATOR COILS OR BOTH ROTOR 
WINDINGS 

MECHANICAL FAILURE 

IRREGULAR POINTER/BALL MOVEMENT 

WORN BEARINGS, DRIED, LUBE 

POINTER OUT OF CALIBRATION ' 

BENT POINTER 

IRREGULAR POINTER/BALL MOVEMENT 

DRIED LUBRICANT 

OPEN CIRCUIT 

NO POINTER MOVEMENT 

NO CONTINUITY 

SHORT CIRCUIT 

NO POINTER MOVEMENT 

LOWER THAN USUAL RESISTANCE 


TABLE 8.3-12 ADI PECULIAR FAILURE MODES - 
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MAJOR COMPONENT 

MODE BY SUB-COMPONENT 

SYMPTOMS 

EXTERNAL 

INTERNAL . 

GLIDESLOPE, DEVIATION 
BAR, COMPASS CARO 

SERVO. MOTOR 

NO NEEDLE/CARD MOVEMENT 

OPEN/SHORTED WINDING 

ERRATIC NEEDLE/CARO MOVEMENT 

BOUND BEARINGS, BENT SHAFT 

POSITION 

POTENTIOMETER 

NEEDLE QUICKLY DRIVEN OFF SCALE 

OPEN WIPER. COIL OR SERIES RESISTOR 

NEEDLE/CARO OPERATES ON HALF OF SCALE 
ONLY. NEEDLE DRIVEN AGAINST HARDSTOP. 

ONE VOLTAGE MISSION ON COIL 

SIGNAL AMPLIFIER, 
MOTOR DRIVER 

NO NEEDLE/CARD MOVEMENT 

OPEN CIRCUIT 

INCORRECT MOVEMENT 

NON-LINEAR VOLTAGE OUtPUT 

CALIBRATION 

POTENTIOMETER 

STEP SHIR IN NEEDLE/CARD POSITION: 
CALIBRATION REQUIRED 

OPEN CIRCUIT IN BYPASS LINE 

NO NEEDLE MOVLKEN f 

opEn coil or stRrsriiKn’raR 

TACHOMETER 

OVER/UNDER SPEED OF NEEDLE/CARD, 
JERKY MOVEMENT 

NO/LOW OUTPUT VOLTAGE. BROKEN SHAFT 
OR GEAR TOOTH. SLIPPING GEAR 

HEADING SELECT BUG, 
COURSE SELECT POINTER 
OR KNOBS 

POTCNT IOMETER 

INCORRECT/NO DC OUTPUT 

OPEN/SHORT CIRCUIT 

GEAR TRAIN 

INCORRECT DC OUTPUT 

FAILED COMPONENT, SLIPPED GEAR OR 
SLIPPING CLUPCII 

NO MOVEMENT OF BUG/POINTER 

SLIPPING GEAR TRAIN 

TO/ FROM INDICATOR 

SOLENOID AND POINTER 

INDICATOR DOES NOT MOVE WHEN TACAN/ 
VOR STATION IS PASSED 

OPCN/SHORT CIRCUIT 

STUCK SOLENOID/ POINTER 

DME 

DECODE-DRIVER MODULE 

WRONG LIGHT SEGMENT (S) LIGHT UP OR 
FAIL TO EXTINGUISH 

DECODE LOGIC MODULE FAILURE 


LIGHT SEGMENTS DO NOT LIGHT UP 

OPEN/SHORT CIRCUIT 
LIGHT SEGMENT BURNED OUT 

ODOMETER GEAR TRAIN 

HO MOVEMENT OF DIGIT WHEEL 

GEAR TRAIN LUCKED 

SERVO MOM, POSITION 
POTENTIOMETER, SIGNAL 
AMPLIFIER, MOTOR 
DRIVER, CALIBRATION 
POTENTIOMETER, 
TACHOMETER 

SEE GLIDESLOPE, DEVIATION BAR AND. COMPASS CARD. 

EXTERNAL SYMPTOMS APPLY TO DIGIT WHEEL(S) INSTEAD OF NEEDLE/CARD MOVEMENT. 


TABLE 8.3-13 FAILURE MODES OF THE HSI 
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HARDWARE MODIFICATIONS 


candidate technique 

RELATIVE 

COST 

MODS TO 
INSTRUMENT 

ADDITIONAL MODS 
EQUIPMENT 

SOFTWARE 

REQUIREMENTS 

REMARKS 

FEEDBACK SIGNAL 
FROM POSITION 
POTENTIOMETER 

LOW 

ADD BUFFER v - / 
AMPLIFIER. TAP 
FEEDBACK SIGNAL 

ONE ANALOG 
CHANNEL PER 
METER 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS 

* 

NO INTERFERENCE WITH NEEDLE. 
LOWEST COST. MOST VERSATILE IN 
SOFTWARE MODIFICATIONS. POSITION 
SIGNAL EXISTS. 

RESOLVER 

FEEDBACK 

LOW 

NONE 

ADD RECTIFIER, 
FILTER AND 
ANALOG LINE 

SHAFT 

ENCODERS 

HIGH ' 

ADD DECIMAL ■ 
SHAFT ENCODERS 
FOR EACH BALL 
AXIS 

ADD BCD ENCODERS 
AND 24 DIGITAL 
LINES 

PROCESSING OF ■ 
DISCRETE DATA 

MOST BULKY MOO TO INSTRUMENT AND 
REQUIRES MOST DIGITAL .LINES TO 
COMPUTER 

t 

SINE-COSIME 

POTENTIOMETERS 

MED 

HIGH 

ADD SINE-COSINE 
POT PER BALL 
AXIS 

ADD 6 ANALOG 
LINES TO COMPUTER 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS 

LOWER ACCURACY. GOOD SOFTWARE ■ 
VERSATILITY, WITH CONTINUOUS ■ 
POSITION MONITORING. 

CODE PINS ON 
BALL 

MED 

HIGH 

ADD BINARY CODED 
PINS TO EACH AXIS 
OF BALL. 450 
INCREMENT 

ADD 12 DIGITAL 
LINES TO COMPUTER 

PROCESSING OF 
DISCRETE DATA 

GOOD ACCURACY. MINIMAL 
FLEXIBILITY. 


TABLE 8.3-14 CHARACTERISTICS OF CANDIDATE TECHNIQUES FOR ADI CHECKOUT 
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APPLIES TO 
INSTRUMENT 
• MOVEMENT ' 

HARDWARE MODIFICATIONS 



1 

CANDIDATE 

TECHNIQUE 

MODIFICATIONS TO 
INSTRUMENT 

ADDITIONAL MODI- 
FICATIONS TO 
EQUIPMENT 

SOFTWARE 

REQUIREMENT 

RELATIVE ‘ 
COST 

REMARKS 

CURRENT 

SENSOR 

DME 

7 ELEMENT READOUTS 

ADD DIFFERENTIAL 
AMP, SWITCH, 
SHUNT RESISTOR & 
STD. RESISTOR 

ADD ANALOG LINE 
TO COMPUTER. ADD 
DISCRETE OUT OF 
COMPUTER 

PROCESSING 
AND EVALU- 
ATION OF 
QUANTITA- 
TIVE PARA. 

• LOW 

MORE RELIABLE IN 
SENSING THAN •PHOTO- 
ELECTRIC SENSORS OR 
THERMISTORS 

DC FEEDBACK 

COMPASS CARD, COURSE 
SELECT POINTER, 
HEADING SELECT BUG, 
GLIDESLOPE, VOR 
DEVIATION BAR 

ADD ONE WIRE 
PER CHANNEL 

ADD DUFFER AMPLI- 
FIER PER CHANNEL. 
ONE ANALOG 
CHANNEL PER METER 

PROCESSING 
AND EVALU- 
ATION OF 
QUANTITA- 
TIVE - 
PARAMETERS 

LOW 

MINIMAL- INSTRUMENT 
MODIFICATION. DIRECT 
DC FEEDBACK EXISTS 
WITHOUT MODIFICATION 
FOR HEADING SELECT BUG 
AND FOR COURSE SELECT 
POINTER 

FLUIDICS 

TO/ FROM INDICATOR, 
OPTIONAL WARNING FLAGS 

VENT CASE. 
INSTALL 2 
FLUIDIC SENSORS 
PER INDICATOR 

ADO AIR SUPPLY 
SYSTEM, ADD 
TRANSDUCERS, ADD 
2 DISCRETE 
INPUTS/METER, 
(ADD POWER 
SUPPLY?) 

PROCESSING 

OF 

DISCRETE 

DATA 


LIMITED VOLUME 
AVAILABLE. SENSES 
INDICATOR DISPLACEMENT. 

SNAP ACTION 
SWITCHES OR MAG- 
NETIC SWITCHES 

- • 

ADD 1 SWITCH 
PER ACTION 

mu— uniinH — 


MOD 

LIMITED VOLUME AVAIL- 
ABLE. CALIBRATION 
INTERFERENCE DUE TO . 
ADDED FORCE REQUIREMENT 

PHOTOELECTRIC 

SENSORS 

• 

"2 SENSORSPER 
INDICATOR 

ADD 1 AMPLIFIER 6 
DISCRETE LINE PER 
SENSOR. ILLUMINA- 
TION SOURCE 
(.POWER SUPPLY?) 

TEST CIR- 
CUIT CHECK- 
ED. PROCES- 
SING OF 
DISCRETE 
DATA 

MOD 

NO INTERFERENCE WITH 
INDICATOR. LIMITED 
VOLUME AVAILABLE. 
SENSES INDICATOR 
DISPLACEMENT. 


TABLE 8.3-15 CHARACTERISTICS OF CANDIDATE TECHNIQUES FOR HSI CHECKOUT 
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' a means of sensing light directly or indirectly is required, coupled with the 
^^eneration of an "on-off" electrical signal to the computer. 

Various techniques were evaluated for self test for the ADI and the HSI. 

Many of these require substantial modifications of the instruments. Modifi- 
cations make the instrument, a "special," require extra drawings, risk damage 
by the act of modification, may upset physical balance, and involve require- 
ments for unknown clearances which may not be available. The recommended 
checkout instrumentation requires minimum modification to the instrument. 

The techniques considered for the ADI are summarized in Table 8.3-14. The 
following additional comments on these techniques may be of interest: 

A. Shaft encoders for each ball axis: Each encoder requires a large 

volume (three times) inside the instrument. Up to eight signal 
wires per axis (24 total) for BCD encoding, plus a common wire, 
would be added for resolution to one degree. This number of wires 
would almost certainly require one or-more additional connectors. 
However, less precise resolution would require fewer wires. The 
encoders would require additional torque from the motors, which 
may then become overloaded. 

' ! 

B. Sine-Cosine potentiometers attached to each ball axis: This 

method requires much less volume, and also requires f ewer wires: 
a total of eight. The resolution is less precise than the shaft 
encoders unless gearing, and extra potentiometers and wires are 
added. In the usual arrangement two continuous-ring potentiometers 
are attached to each axis. Equal voltages of opposite polarity 
are applied 180° apart to each potentiometer ring, but the two 
potentiometers on the same axis are shifted 90° to each other. 

Thus, one potentiometer gives the sine signal: the other gives 

the cosine signal. 

C. Code pins or special contacts every 45° in each axis of the ball: 

By using fewer test points than plan A (shaft encoders), the 
number of wires and the physical volume are reduced. Binary coded 
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contacts every 45° in each axis requires a maximum of four contacts 
per check point, and 12 extra wires at the connector. Unless 
the binary coded contacts can be hidden like those for the roll 
.axis yoke, the ball would be unsightly and astronaut training 
value would be degraded that much. 

The techniques considered for the HSI are summarized in Table 8.3-15. 

The Horizontal Situation Indicator and Attitude Director Indicator are 
multi -component instruments. The recommended checkout technique for each 
- component is discussed below. 

It is recommended that the feedback loop signal from each servometer 
pointer movement be buffered and sent to the computer for analysis. The 
resolver feedback/posi tioh signal of the ADI should be rectified and also 
sent as an analog voltage to the computer for analysis. The correct 
resolver signal should be a null voltage, whereas the servo feedback voltage 
will vary from -15VDC to +15VDC. 

The Horizontal Situation Indicator is similar to the DC servo driven 
meters except the TO/FROM Indicator, DME Readout,, Heading Select Bug, and 
Selected Course Pointer. 

Since there are several types of instrument movements within the HSI, 
each movement is treated s^'rately in the checkout. The recommendations 
for each component are listed below and the associated hardware requirements 
are described. 

* 

ADI Self Test Hardware 

The ADI has a sensor for detecting pointer movement and a proportionate 
electrical response signal (the position potentiometer) for each of the six 
pointers. These position signals can be tapped externally and sent to the 
computer via analog-to-digi tal channels, one for each pointer. See Figure 
8.3-13. This idea is discussed in more detail in paragraph 8. 3. 3. 3. 
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Similarly, each axis of the attitude ball has a resolver feedback 
signal that can be tapped externally, rectified from AC to DC, filtered, and 
^’ent to the computer via an analog-to-digital channel. When the signal is 
at a null (zero volts) the ball has arrived at the commanded position. See 
Figure 8.3-14. 


Final instrument design may necessitate one or more impedance buffers 
for computer interface circuit compatibility. The computer software will 
check the pointer movements similarly to the DC servo driven meters described 
in paragraph 8. 3. 3. 3. The attitude ball can be checked by incrementing each 
axis 45° until a full revolution is completed, and reading the null voltage 
at the completion of each command. 

The feedback signals. also permit dynamic testing to be performed by 
applying step response analysis techniques, that can detect degraded perfor- 
mance or incipient faults. 


HSI Self Test Hardware 

The recommended techniques for self test of the HSI components may be 
Summarized as follows: 


Component 
DME Readouts' 

To/From Indicator 

VOR and Localizer Deviation Bar 

Course Select Pointer 

Glideslope Pointer 

Heading Select Bug 

Compass Card 


Checkout Technique 
Current sensors 
Current sensors 
Potentiometer position* 
DC position signal 
Potentiometer position* 
DC position signal 
Potentiometer position 


*A servo motor movement is assumed on the Shuttle. The King Radio Corp. 

KI525 Pictorial Navigation Indicator has a galvanometer. If a galvanometer 
is used on this instrument, reference is made to paragraph 8.3.2 for checkout 
techniques. ’ 
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The current sensor for the seven-element DME readout assemblies is shown 
in Figure 8.3-18. Its principal component is a differential amplifier that 
^easures the IR drop -(current x resistances voltage) 'across a shunt resistor, 

"R s , during the checkout. During normal simulator operations R s is effectively 
out of the circuit by the closure of the nearby switch, Sy. The power supply 
may vary as much as 5 to 10%, the differential amplifier by 2% and the 
incandescent bulbs by 5% (LEDs by 50%). Therefore, a maximum, of one digit 
{seven incandescent elements) -may be tested at one time. This quantity of seven 
segments means that all tolerances may accumulate to about 14% maximum (9 segments 
are restricted to 12%, and 58 segments are limited to less than 2%). Beyond 
that' tolerance, detection of a burned out segment is not assured. The 
variations in power supply voltage and other circuit conditions are minimized 
by comparison of each di-git (or group of segments) to the reading obtained 
from the "standard resistance" resistor in parallel to the seven element 
digits. Therefore, incandescent readouts may be tested by illuminating one 
digit at a time and measuring current flow with the differential amplifier. 

Only two or three LED segments may be tested at a time. Each segment(s) or 
digit would be turned ON/OFF by computer control. 

.The current sensor for monitoring the TO/FROM indicator is a transistor 
amplifier that is mounted externally. The only internal addition to the 
instrument is one more wire, which is brought through the instrument case to 
the base of the transistor. There is also one discrete channel to the computer. 

I 

Where servo movements are used, the potentiometer position feedback signal 
can be buffered and sent to the computer for analysis. See paragraph 8.3.3 
and Figure 8.3-16 for more details. 

The course select pointer and heading select bug send DC position signals 
external to the instrument. These signals can be processed similarly to the 
servo feedback signals. See Figure 8.3-19. 


ItEPKODUCIBILlTY OF THE 
OBIGEKAL PAGE IS POOP- 
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8. 3. 4. 4 Self Test Software and Data Base Impact 

.. The software flow logic for executing the calibration checks for the ADI 

shown in Figure 8.3--20. Although error messages are shown- in this flow 

chart, these messages could 'be issued by the executive software as part of the 

summary results of the total crew station test results. Dynamic test flows 

for the’ ADI are shown in Figure 8.3-21. Software requirements in addition to 

the. servo and galvanometer test flow charted in the previous section are ' 

* 

presented. in Figure 8.3-22 for the Horizontal Situation Indicator. v 

1 

Incipient fault detection requirements for these devices may be 
considered minimal because of their high reliability in past applications. 
However, for maintenance insurance in a high utilization, heavy training 
schedules condition, it. is expected that the concept of marginal or gray area 
performance may be applied to detect degradation to unsatisfactory’ levels of 
component performance in these instruments. These components would be in the 
servo driven and the galvanometer movements. 

# 

The data base impact for these devices is very limited since vie are 
^addressing only two specific instruments. Each servo drive requires three 
nominal values and two sets of tolerances for each. That is a total of nine 
parameters stored for each servo. .Galvanometers require basically two 
parameters with tv/o sets of tolerances for each, for a total of six parameters. 
All discrete indicators are tested using computed references. The total 
floating point parameters for which data will require storage are as follows: • 

O • 

'ADI . 81 parameters • • 

HSI 21-30 parameters ■ 

These parameters would be stored as floating point data. 
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Test Servo drives 
for the attitude 
ball 


Test Pointers 
(Galvanometer) 


FIGURE 8.3-27 ADI DYNAMIC TEST SOFTWARE FLOW, ADIDT 
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HSITST 


SET TO/FROM 
INDICATOR TO 
“TO" 


MEASURE Vstd 
OF "STANDARD 
RESISTANCE 
RECORD VALUE 


s indicators NO 

SET TO "TO" /> 


SET TO/FROM 
INDICATOR TO 
"FROM" 


Vindicators, no 

SET TO "FR0M'>— H 



PRINT "TO/ 
'FROM" INDICA- 
TOR DID NOT 
GO TO "FROM" 


LAMP TCST 
NEXT DIGIT 



'STD^ 

GT "HSI-DME 

V SERMFNT(S) 

:git^ 

V BURNED OUT 



TURN OFF ALL 
ELEMENTS 


_^SRE \ 
ALL ELEMENTS 
TURNED OFF? „ 


lAST DIGIT 
SEEN TESTED?^, 


PRINT 

NO "HSI-DME 

— SEGMEHT(S) 

FAILED ON" 



CALL 5ERTST 


Servo driven 
meter dynamics 
test 


CALL GALTST 
Gal variometer 
test 



TO/FROM INDICATOR 


' DME READOUT 

FIGURE 8.3-22 HSI TEST SOFTWARE FLOW, HSITST 
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^8.3.5 Lighted Indicators 

There are 700 lighted indicators in the Shuttle Mission Simulator that 
need to be checked for correct operation. This section reviews various tech- 
niques to verify their proper operation and recommends one specific approach 
for use in Shuttle simulators. 

8.3. 5.1 Description and List of Displays Applicable 

The lighted indicator is an individual indicator,- an assembly of indica- 
tors, a component of a push button switch, or an individual segment of a dig- 
ital readout. Most indicators are DC, but a few are AC powered. See Figure 
8.3-23 for typical assemblies, and- Figures 8.3-24, -25, and -26 for typical 
circuits. 

Most indicators are of the incandescent type or of the light emitting 
diode (LED) type. With an overvoltage application, more light is radiated, 
but fai lure, occurs much sooner. Incandescent bulb life varies as the ratio 
of (rated voltage/applied voltage)^. Bulb life can be greatly extended by 
I the application of a -slightly lower voltage. As shov/n in Figure 8,3-27, the 
application of 95% of the rated voltage will extend the life to about 1.85 
times the normal -life while reducing the candlepower to about 84% of the 
nominal brilliance. 

Electroluminescent (EL) lights are constructed similarly to a capacitor 
whose plates remain flat. An electrical short may occur where the edges are 
cut and not properly dressed. Otherwise failure by gradual dimming occurs 
with age - with the application of a constant voltage and frequency. A gen- 
eral description of lighted indicators is given in Table 8,3-16. 

This analysis assumes that at the start of the checkout test, the 
computer checks the lighted push button switches to verify that they are all 
in the position which turns on the associated light. Refer to Figure 8.3-26. 
If any are OFF, the computer controlled manipulator is commanded to turn the • 
proper switches OH. If any such switch does not change state after the man- 
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FIGURE 0.3-23 . LIGHTED INDICATORS AMD PUSH BUTTON SNITCHES • 
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FIGURE 8.3-24 CURRENT SENSING DIAGRAM FOR DC CIRCUITS 


ADDITIONAL HARDWARE FOR 



FIGURE 8.3-25 CURRENT SENSING DIAGRAM FOR AC CIRCUITS 


8-136 

/V 7 CDOA//VE 1 .I. DOUGLAS ASTf?OA/AUTfCS CO/WP/I/VV • £457 


\ 





AVERAGE LIFE (MUITIPLYINO TACTOR) 


MDC Ell 50 
1 November 1974 



FIGURE 8.3-26 CURRENT SENSING DIAGRAM FOR PUSH BUTTON SWITCH 


The graph illustrates the manner in which current, candl 
power and life performance varies with percent changes i 
applied voltage. These values are typical for CM miniatui 
and subminiature lamps. 


RERATED M.S.C.P.= 

/ V \ 3.5 Y M.S.C.P. AT 
\ V J ^ DESIGN VOLTS 

RERATED LIFE= 

/ V.\ 12 v LIFE AT 
\ V ) A DESIGN volts 
v = a'pplication voltage 

V, = DESIGN VOLTAGE 


FIGURE 8.3-27 LAMP LIFE AND CANDLEPOWER VS. APPLIED VOLTAGE 
FROM CHICAGO MINIATURE LAMPWORKS 
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TABLE 8.3-16 
LIGHTED INDICATORS 


INPUT: + VDC or - VDC 

GROUND (CONTROL SIGNAL) 

0-110 VAC.400 HZ ) 

O’ - 110 VAC, 60 HZ ) F0R ELECTROLUMINESCENT LIGHTS 


OUTPUT: LIGHT ULTRAVIOLET RADIATION 

HEAT INFRARED RADIATION 

LIFE EXPECTANCY: 

SWITCHES: . 50,000 HR AT RATED LOAD 
INCANDESCENT: 150 TO 100,00 HR 

QUANTITY: 400 IN CREW STATION 

300- in IOS 

EXPECTED FAILURE MODES: 

OPEN CIRCUIT 
• SHORT CIRCUIT 

ELEMENT OF BULB BURNED OUT . 

LOOSE BULB OR CONNECTOR 

EL TYPE ONLY - SHORT BETWEEN THE TWO- ELEMENTS AT ANY EDGE. 
GRADUAL DIMMING WITH AGE. 

CRITICAL MEASUREMENT POINTS: 

SOCKET/CONNECTOR/TERMINAL BOARD TERMINALS 
LIGHT ON/OFF 
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j^'pulator turns it ON, a second attempt' is made to turn the switch ON. !f the 
second attempt fails, the switch is assumed to have failed and the appropriate 
message is printed by the computer. 

8. 3. .5. 2 Characteristic Parameters 

LEDs normally fail in an open circuit mode. Even if the fault is a short 
circuit, it soon burns into an open circuit - either in the diode .or ; -its driver 
circuit, . ' 

\ 

Characteristic parameters are simply the light status, ON or OFF. ' . 

8. 3. 5. 3 Hardware and Software Requirements 

Automated checkout or self test of lighted indicators requires a means for 
sensing light, heat, current flow or other related physical characteristic in 
response to a voltage input; and the generation of an electrical response sig- 
nal indicative of light output, which can be communicated back to a computer 
for processing. The recommended" technique is current sensing. 

I 

Figures 8.3-24, -25, and -26 are schematics of ho w a current flow through 
various indicators can be sensed. Figure 8.3-28 gives the software flow diagram. 
Current flows through the transistor when a' voltage appears at its base; this 
voltage appears v/hen the light is turned off and a very small current flows 
through the bulb and Timiti/>n resistor. 

U ' i 

The advantages of this recommended technique is that an immediate response 
and a positive indication are given. It is not affected by stray/adjacent 
lighting or adjacent heat generators. No warm up or cool down time is required. 
The circuit checks both the light segment and the driver/supply voltage. 
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FIGURE 8.3-28 SOFTWARE FUNCTIONAL FLOW DIAGRAM 
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u 8.3.6 Bilevel Electromechanical Flags 

This section describes various techniques for checking the 400 bilevel 
electromechanical flags in the Shuttle Mission Simulator or other Shuttle 
simulators. One specific technique is recommended, based upon cost and proof 
of operation. 

8. 3. 6.1 Description and List of Displays Applicable 

Each flag assembly is a two- position indicator, electromechanically ac- 
tuated. One position shows a grey panel, the other position shows a black 
and white barber pole pattern. With the application of rated voltage, the' 
flag (drum) is moved to the alternate position. When the voltage is remov- 
ed, a spring returns the flag to the original position. See Figure 8.3-29 
and Table 8.3-1 7 ’for physical and electrical characteristics. Internal diodes 
permit the addition of test circuitry in the Shuttle simulator. Figure 
8.3-30 shows the circuit of a typical flag that was used in the Apollo Command 
Module Procedures Simulator (CMPS) . 

Flags have a higher reliability than lamps in general. Therefore, they 
are used as "fail-safe" valve position displays for propulsion systems such 
as the Reaction Control System. 

Some flags have a different construction than shown in Figure 8.3-29. 

They have a grey panel that drops in front of the barber pole. The grey panel 
is moved by a solenoid operated slider mechanism. This type has more failures 
than the drum type. 

The following analysis 'assumes that the correct voltage is applied to the 
terminals as a result of previously performed, checkout and calibration on the 
rest of the simulator equipment. 

8. 3.6. 2 Failure Modes and Characteristic Parameters 

Table 8.3-18 lists the failure modes and related symptoms. The most 
failures have occurred in the type that utilize a slider mechanism. All listed 

vv 
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costa ms 

ELECTRQW&NETIC 

COIL 


FIGURE 8.3-29 ASSEMBLY OF BILEVEL, ELECTROMECHANICAL FLAG 


TABLE 8.3-17 BILEVEL, ELECTROMECHANICAL FLAGS 



INPUT: 0 and +28 Vdc 

OUTPUT: Flag Movement, Two Positions 

REFERENCE CONFIGURATION QUANTITY: 200 in Crew Station 

200 in Instructor/Operator Station 

EXPECTED FAILURE MODES: 

Short Circuit 
Open Circuit 

No change due to dried lubricant or broken spring 
Electrical overload may bend or break mechanical part(s). 
Open/Shorted Diode 
Open/Shorted Solenoid Coil 

CRITICAL MEASUREMENT P0INT5: Input Terminals 

. • Flag Position 
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TABLE 8.3-18 FAILURE MODES 


MODE 

SYMPTOMS 

BY FAILURE 
OF. COMPONENT 

EXTERNAL 

INTERNAL 


NO FLAG MOVEMENT 

OPEN DIODE 

DIODE 

FLAG MOVEMENT IS UNPREDICT- 
ABLE DUE TO UNKNOWNS IN 
EXTERNAL CIRCUIT 

SHORTED DIODE - 
CONTINUITY IN BOTH 
DIRECTIONS 


NO FLAG MOVEMENT 

OPEN COIL 

SOLENOID COIL 

FLAG MOVEMENT IS * 
UNPREDICTABLE 

SHORTED COIL 

OPEN CIRCUIT 

NO FLAG MOVEMENT 

NO CONTINUITY 

SHORT CIRCUIT 

NO FLAG MOVEMENT 

LOWER THAN USUAL RESISTANCE 

SPRING 

NONE - IF GRAVITY AND . 
SPRING RETURN FLAG TO SAME 
POSITION. FLAG MIGHT 
"FLOAT” IF POWER IS OFF AND 
CREW STATION MAKES STRONG 
PITCH MOVEMENT. 

BROKEN SPRING 

SLIDER (ONE TYPE) 

NO MOVEMENT 

DRIED LUBRICANT, LOOSE PIN 



GRIMES 6,5-0167-1 
\ 

'FIGURE 8.3-30 SCHEMATIC OF ELECTROMECHANICAL FLAG 
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failure modes and checkout techniques also apply to it, but the drum- type is- 

ifehe one that is expected- to be used in the simulator. Therefore, the text is 

v 

directed to the, drum type of flag. 

8. 3. 6. 3 Hardware and Software Requirements 

Automatic checkout or self test of. a flag assembly basically, requires, a 
means for sensing flag movement in response to, voltage input, and the genera- 
tion of an electrical response signal indicative of flag position, which can 
be communicated back to a computer for processing. ' 

Techniques evaluated and summarized in Table 8.3-19 included contacts for 
continuity checks and position potentiometers. 


Electrical Contacts for Continuity 

.The flag position is sensed by ‘two continuity pins: one at each of the 
alternate positions. If the moveable, grounded contact touches the pin at 
the extreme roll of the drum, a ground signal' is sent to the computer. The 
pins are flexible to reduce shock and to provide tolerance for misalignment. 
'The flexibility also permits wiping action that is' necessary .to reduce the 
buildup of high resistance material. Newer alloys have been developed to 
replace gold as contact plating material. Characteristics or properties are 
nearly as good as gold. This checkout technique gives reliable position in- 
formation at a reasonable cost. See Figure 8.3-30. 


Feedback Signal from a Position Potentiometer 

A potentiometer can be mounted inside the case so that the wiper is 
moved in a fixed ratio to the drum rotation. The voltage from the wiper 
would be sent to the computer via an analog to digital line. The voltage 
applied to the potentiometer end terminals, +V^pp and ground or ~ V REF’ 1S 
dictated by the simulator computer analog system and the system designer's 
choice. 


Since the flag is a bilevel device, there is no need to check, interme- 
diate flag positions. However, use of the feedback signal as a flag posi- 
tion indication enables implementation of simple steady state testing or of 
Cecording of the dynamic response to a step input. 
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CANDIDATE 

TECHNIQUES 

RELATIVE 

COST 

HARDWARE MODIFICATIONS 

SOFTWARE 

REQUIREMENTS 

REMARKS . 

MODS TO 
INDICATORS 

ADDITIONAL MODS 
TO EQUIPMENT 

CURRENt 

SENSOR- 

LOW 

ADD 2 CONNECTIONS TO 
EXTERNAL AMPLIFIER 

ADD TRANSISTOR AMPLI- 
FIER AND ONE DISCRETE 
LINE TO COMPUTER FOR 
EACH INDICATOR 

PROCESSING OF 
DISCRETE -DATA 

f. 

DOES NOT PROVE MOVEMENT 

ELECTRICAL 

CONTACTS 

LOW 

ADD MOVEABLE CONTACT 
AND 2 TERMINALS 

ADD 2 DISCRETE LINES 
TO COMPUTER PER 
INDICATOR 

PREFERRED METHOD 

POTENTIOMETER 

MED 

ADD POTENTIOMETER 

ADD ONE ANALOG CHANNEL 
PER INDICATOR 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PAPAMETFRS 

COMPUTER ANALOG INTERFACE 
MORE COSTLY THAN DISCRETE 
INTERFACE 

TV SCAN 

VERY 

HIGH 

NONE 

SFRVO DRIVE FOR CAM- 
ERA^), TV CAMERA (S ) , 
CONTROL CIRCUITRY, 
VIDEO PROCESSING 
HARDWARE, ANALOG 
LINES TO COMPUTER 

COMPLEX • 
PROCESSING OF 
IMAGE DATA 

MULTI-INSTRUMENT USAGE 
LOWERS RELATIVE COST. 

FLUIDICS 

MED 

ADD FLUIDIC PORTS, 
RELIEF 

ADD FLIP-FLOPS, 
TRANSISTORS, AIR 
SUPPLY SYSTEM, 2 
DISCRETES PER FLAG 

PROCESSING OF 
DISCRETE DATA 

PACKAGE SIZE QUESTIONABLE. 
■EXTRA MAINTENANCE AND 
PNEUMATIC HARDWARE 
REQUIRED. 


2 = 
O 
< 
m 
3 
c r 
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“S 
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TABLE 8.3-19 CHARACTERISTICS OF CANDIDATE TECHNIQUES 
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^ The cost of modifying the flags for either discrete, contacts or for 
potentiometers is about the same. However, the cost of computer analog 
Interface for the potentiometers is considerably higher. Therefore, the 
.preferred method is to modify the flags to add electrical contacts. 

The software requirements for flag testing are identical to those for 
lighted indicators since both are two position or condition devices. 
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8.3.7 CRT Graphics Display 

y There are five CRT displays on the IOS for providing interactive communi- 
.ations between the HOST and the instructors, and for giving the instructors 
the capability to monitor visual displays presented to crew members. These 
CRT's, together with associated alphanumeric and special function keyboard are 
used by the instructors to insert simulated malfunctions for training purposes 
and to control the progress and execution of the simulation task. 

One instructor has two CRT's to completely monitor performance of the 
Commander trainee, while the other instructor has two CRT's to monitor Pilot 
performance. A fifth CRT, centrally located between the two instructors, 
provides a display of Event Time Monitoring functions. In addition to these 
five displays, there will be video monitors on the IOS which duplicate the 
flight graphics displays on the Crew Station panels. 

Primary usage of the CRT displays is in presenting alphanumeric data to 
the instructors. Graphic display information will include bar type meters and 
a few circular meters. None of these applications require color presentation 1 , 
md, therefore, a monochromatic system is used for this analysis. 

w 

8. 3. 7.1 Hardware Description 

Typical of these types of CRT Display Systems is the ADAGE/400 system, 
which is being used by Goodyear Aerospace Corporation in the F-15 simulator and 
by General Dynamics in the F-lll simulator. This display system is a low cost 
system that provides full general purpose -graphics and alphanumeric display 
capability, using a random draw, stroke writing technique rather than a raster 
scan technique. Figure 8.3-31 presents a block diagram of the CRT Display and 
Keyboard System for the IOS using the ADAGE elements. Besides the CRT displays, 
there are four major elements in the system. They are: 

1. The minicomputer Interface. This unit provides timing and formatting 
services for display data transferred between the display system and • 
the minicomputer. Refresh of display data can be performed directly 
from the minicomputer through this interface, or the interface can 
store display information in a buffer memory and provide the necessary 
control to refresh display 30 or 40 times per second or as desired. 
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FIGURE 8.3-31 ' DISPLAY SYSTEM FUNCTIONAL BLOCK DIAGRAM (ADAGE/400) 
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Including the refresh- task in the Minicomputer Interface cuts down 
the amount of data traffic on the minicomputer I/O ports and therefore * 
frees the minicomputer for communication with other devices, j 

2. The Digital Graphics Controller. Some of the most advanced technology 
features of the system are included in this unit in that it is this 
circuitry that performs 'hardware transformation for image rotation 
computations and other perspective related processing. 

3. The Hybrid Stroke Generator.' This unit contains the necessary hard- 
ware to format alphanumeric characters in the desired font. Vector 
generation as well as circle and arc generation capabilities are 
included in this element. • 

4. The Remote Console. This console contains the alphanumeric keyboard, 
light pen, joy stick, control switches and indicators, and serves 

as a control panel for manual control and checkout of the display 
system. 

Up to sixteen terminals can be operated simultaneously and independently 
from a graphics central controller. This controller, which could’ be any of, 
various minicomputers in the market - such as the PDP-11, in turn is connected 
to the HOST computer that ultimately determines the contents and format of the 
data displayed. 

" ‘ ■** 

8. 3. 7. 2 CRT Graphics Test Techniques 

The diagnostic programs supplied by the vendor are intended to determine 
the overall readiness of the system and, in the event of a failure, tp isolate 
the fault to a group of three or four integrated circuit modules in the display 
electronics circuitry. Maintainability features of the hardware, together with 
this diagnostic software capability can achieve a Mean Time To Repair for the 
display system in the area of ten to fifteen minutes. 
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^ The basic self test diagnostic process consists of calling up various test 
atterns that exercise the character, vector, and circle/arc generation capa- 
bilities of the system. Verification of displays obtained is performed by a 
human observer. The patterns are so designed as to point out subtle faults in 
the display system components.' For example, a long diagonal line is generated 
by multiple short vectors. A problem in the vector computation or generation 
circuitry can be isolated to the small group of components involved with the. 
length, orientation, or flicker characteristics of an out of line segment. 

The Digital Graphics Controller microprocessor can store in firmware the 
desired test patterns for display system self test. The same patterns can be 
issued from the graphics minicomputer in order to test not only the displays, 
the stroke generators and the microprocessor, but also the refresh circuitry 
and other elements in the Minicomputer Interface. This capability to generate 
test patterns at different points in the display string permits the fault 
isolation process to be conducted efficiently using the resources for automatic 
test control contained in the basic system. 

The test software and hardware described below are offered by some display 
system manufacturers as part of their basic system configuration, and are 
additional features offered by other manufacturers. Procurement of interactive 
CRT display systems for Shuttle simulators should emphasize the inclusion of 
self test hardware and software that achieve the now realistic goal of ten to 
fifteen minutes MTTR. 

8. 3. 7. 3 CRT Graphics Test Software Requirements 

Typically, using the ADAGE/400 system for. reference, the following elements' 
of test software are found to make up the self test software package. It should 
be noted that this software is intended to isolate a fault to a removable circuit 
board in the card chassis. There are seven boards, and seven corresponding groups 
of tests as follows: 

1. Minicomputer Interface Test. This package of test software verifies that 
the minicomputer is capable of establishing a communications link with 
the display system, and that address, command, and display data can be 
transferred correctly in both directions. 
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2. Digital Graphics Controller display and command processing test- This 

software verifies correct interpretation of display and command data by 
the logic circuits in the host board of the Digital Graphics Controller. 
Verification is performed by the minicomputer based an messages returned 
from the DGC. . \ 

3 . DGC Arithmetic Unit test. The computing capability of the DGC micro- 
processor is tested by this program by commanding execution of a. sequence 
of instructions that verify this capability thoroughly. A faulty result 
would point to a fault within the DGC Arithmetic Unit board. 

4. DGC Memory Test. All the memory locations in the DGC scratch pad memory 
are written into and read out to verify bit by bit integrity. The Read 
Only Memory of the microprocessor used for special test pattern 
generation is also verified from the minicomputer by this test. 

5 . Character Generator Test. This software verifies the capabilities of the 
character generation circuitry, by commanding displays of alphanumeric 
information and verifying responses from the Hybrid Stroke Generator. 

It should be pointed out, however, that this and the following two tests 
intended to check the HSG cannot perform a complete automatic self test. 
Human observation of character, vector, and circle/arc displays is 
required to fully verify this HSG hardware. 

6. Vector Generator and Circle/Arc Generator Test. This test causes random 
drawing of vectors, circles, and arcs and checks for specific responses 
from the HSG, and from the human observer prior to advancing the test or 

4 

issuing an error message. 

7 . > Stroke Generator Conversion Board Test. These tests verify adequacy of 

digital/analog conversion circuitry in the HSG. 

The above tests are included in the ADAGE supplied test software package which is 
made up of the HCIT1 programs that perform test number 1 above; the DGCRT programs 
that include tests 2 , 3, and 4; and DIXLD that perform tests 5, 6, and 7. This 
>ackage does include the capability to isolate to a group of IC's within a board, 
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owever, if a board is defined as an LRU.; that level of isolation becomes more 
trlngent than required to- meet the basic fault isolation objectives stated for the 
study. 


It is reasonable to specify that a CRT graphics system obtained from 
competitive suppliers include the self test capability described above. 
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8.3.8 Controls Overview 

| The function of a control device is to transform a mechanical input such 
as position, motion, or force into an electrical signal. The mechanical input 
can come from a controlling system or from a human operator; in the case of 
the simulator, this input comes from the trainee. The electrical signal output 
is routed to the computer as an input to simulation sequence control, or math 
model processing. The type of controls of concern to the study are discrete 
devices such as toggle and pushbutton switches, or analog devices such as 
potentiometers or synchro/resolver control networks connected to hand or foot 
activated controls such as hand controllers or rudder pedals. 

8. 3.8.1 Control Device Self Test Considerations 

Using the stimulus/response approach to self test of controllers, it 
becomes evident that some automatic means of control activation and control 
signal monitoring are required to test these control devices. The monitoring 
function poses absolutely no problem as the electrical signals output from 
control devices are routed to the computer. for normal operation of the simulator. 
Where the real problem arises is in implementing an automatically controlled ' 
source of mechanical motion to be applied to the device being tested. ' It 
should be remembered that control devices are the command link between man and 
computer. The automatic actuator, then, has to take the role of the human 
operator and do so without interfering with normal operation when the human is 
at the controls. Fidelity of simulation is of primary concern in training 
simulators and the introduction of automatic control actuators can impair this 
fidelity, and therefore reduce the operational effectiveness of the system. 
Therefore, any method used to automatically actuate simulator controls should 
meet the following criteria: 

1. Automatic control actuation hardware should not affect the feel of 
the control device, or change the amount of force that the human 
operator must use in actuating that control. 

2. Installation of automatic control actuation hardware should not impair 
the aesthetic fidelity of the crew station. This means that no levers. 


8-153 


MCDONNELL. DOUGLAS ASTRONAUTICS COMPANY - CAST 



MDC Ell 50 
1 November 1974 


linkages, cams, hinges, or bulges should be visible to the crewmen if 
these levers, linkages, etc. have been added to the simulator K>r 
automatic control actuation purposes and are not part of the operational 
vehicle crew station. 

8.3. 8.2 Control Device Self Test Implementation 

The main concern in implementing the control device self test capability 
then is to assure that the method used for control actuation does not interfere 
with the positive training aspects of the simulator. As mentioned above, there 
are discrete output and analog output control devices. The method of actuation 
for each type can be radically different. 

In the discrete output case, all that is needed is some non-interfering means 
to move the control handle, lever, or button to its extreme positions, without 
regard as to the amount of force needed or the behavior of the control in between 
extremes. Toggle and pushbutton switches, as well as two position control 
handles and levers, can be actuated by individual electromechanical actuators, 

>uch as solenoids, or by a single actuator that drives multiple control devices 
while the actuator is driven by a single motor or electromechanical driver. 

A. technique for multiple control device activation from a single actuator is 
illustrated by the movable panels or tumblers shown for toggle switch actuation 
in Section 8.3.9 . 

Analog output control devices pose a calibration test problem in that the 
output must be proportional to the mechanical action induced, and this propor- 
tionality must be maintained within design specifications of the corresponding 
flight component. In order to assure proper calibration, some standard must be 
used in applying the amount of force or displacement desired on the control 
device. This standard can be a properly designed, tested, and calibrated servo 
driven actuator. • Commands from the test control computer to this servo actuator 

4 

can cause the actuator to apply a predetermined amount of force or displacement 
to the control device. The resulting output signal can then be measured and 
compared with the calibration data for that control device. The entire range of 
the control device can then be tested, not only as to the ability of the device to 
'espond to the input motion, but also to verify that the resulting signal is of the 
proper magnitude and electrical characteristics, 

■8-154 

MCDOiVAf ELL DOUGLAS ASTRONAUTICS COM RANT - EAST 



MUU tl l&U 
1 November 1974 


8.3.9 Toggle Switches 

| This section describes various techniques for checking the 600 toggle * 
switches in the Shuttle Mission Simulator or other Shuttle simulators. One 
specific technique is recommended, based upon cost , and proof of functional 
operation. 

8. 3.9.1 Description' and Type of Functions Applicable 

The toggle switches are two-pole Microswitch 2TL1 , two or three position 
switches.' The reference configuration switches have one OFF position. One 
pole provides the ON position(s) or data bit input(s) (DBI): i.e., ground or 

open circuit to the computer. The other pole, if used, provides switching 
for IOS panel components or peripheral circuits. 

Typical spacecraft functions that are switched by the toggles are solenoid 
operated fuel /oxidizer valves, power bus, audio and navigation signals, tank 
heaters and fans. . _ 

The switch contacts are silver cadmium oxide, step terminal construction, 
^on-shorting, snap action, either maintained or momentary position,' toggle 
action, and sealed. See Figure 8.3-32 for mechanical and electrical informa- 
tion that has been excerpted from Microswitch catalogs. Table 8.3-20 contains 
simulator related information. 

8. 3. 9. 2 Failure Mode Analysis 

Switch life rating is normally stated for switching 28 VDC resistance 
loads at sea level, at 50,000 feet altitude, and also for "dry" switching. 

The current rating for a given switch increases as DC voltage decreases. 

The switch capability for DC "lamp" loads is lower than for "resistiye" loads 
because of the high inrush currents when the incandescent bulb is cool. In- 
ductive loads tend to burn the contacts by prolonging the arc when the circuit 
is broken by the switch. Typical DC ratings are 20 amps resistive load, 15 
amps inductive load. Altitude (reduced air pressure) in non-sealed switches 
-reduces the density of the air which is an insulator. This reduced insulation 
increases the burning of the contacts for inductive loads. Typical ratings at 
equal voltages are 3 amps inductive at sea level, 2-1/2 amps at 50,000 feet. 
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"TL" LEVER ACTUATED TOGGLE SWITCHES 



j STANDARD TOGGLE LEVER 

, . I 



Standard toggle lever operates on a direct action spring 
, loaded toggle mechanism to provide excellent tactile feed- 
! back in both the momentary and maintained toggle posi- 
i tions. The toggle lever is approximately 5/8-inch long and 
_ has a non-glare matte nickel plated finish. 


© ENVIRONMENT-PROOF SEALING 
©I-, 2-, AND 4-POLE CIRCUITRY 

© STANDARD AND PULL-TO- 
UNLOCK TOGGLE LEVERS 

© 2- AND 3-POSITION, MAINTAINED 
AND MOMENTARY TOGGLE 
ACTION 

Type “TL” toggle switches are the most versatile line 
of toggle switches offered by MICRO SWITCH to the 
military 'aerospace and commercial aircraft industries. 
Versatility is accomplished by combining a choice of 
toggle levers with two- and three-position maintained 
and momentary toggle action, and 1-, 2- and 4-pole 
circuitry. The high strength, temperature resistant, 
non-tracking case material, silver cadmium oxide 
contacts and the step terminal construction assure 
electrical stability and non-shorting wiring connections. 
Operating temperature range is from — 85° to -f-160°F. 
TL toggle switches meet military Specification Number 
MIL-S-3950 (Immersion). 



! Weight: One Pole — 1.44 oz. 

, Two Pole — 1.92 oz. - 


TGURE 8.3-32 MECHANICAL DATA FOR 2TL1 SWITCHES 
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' ' TABLE 8.3-20 TOGGLE SWITCHES 

Input: 0 VDC (ground) 

- 28 VDC 

Output: Input voltage 

Open Circuit 

Reference Configuration Quantity: 250 two position 2 pole 

350 three position 2 pole 

Contact resistance: About .010 ohms, initially 

Design Life: 25,000 cycles 

Expected Life: Dry 1 Data 

> Not 

Load j Available 

Expected Failure Modes: excessive resistance 

V* 

open circuit (broken contact supports) 
closed circuit (welded contacts) 

mechanical (detent spring) 

Critical Measurement Points: Input/Output Terminals 
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DC voltages shorten life more than AC voltages of equal magnitude. 'Typ- 
ical 115 volt, resistive ratings are 3/4 amp DC and 15 amp , AC. DC currents 
transfer the metal plating on the contacts in one direction only, whereas 
AC currents transfer the plating back and forth between contacts because of 
positive and negative voltages. The AC circuit is also broken at' various- 
voltage levels. 'The- one-way DC transfer builds .metal on one contact and 
causes pits on the other contact. This increases resistance, which increases 
the temperature, which in turn increases the rate of metal transfer. When 
the temperature of touching contacts becomes high enough, the contacts weld 
together. This welding temperature is- usually lower than that of the pure 
element contact because an alloy is now present. This lower "eutectic" 
(alloy) temperature varies with- the metal elements present and the ratio of 
each. In some cases the contacts could vaporize if they are separated while 
the contacts are hot. 

In cases where only small currents flow,- the heat produced (.,239 I Rt 
calories, or .239 times current squared multiplied by the contact resistance, 
and time in seconds) may never be enough to cause welding. However, in com- 
puter bilevel circuits, the IR drop (voltage drop as a product of current 
and resistance) may be great enough that the computer will never recognize 
'a change in switch position. When the switch switches between ground and 
open circuit the computer input line voltage should alternate between ground 
and V + . If the voltage drop across the switch contacts raises the "ground" 
voltage above the computer's threshold voltage (about 1 volt), the boolean 
never changes state. At this point the switch is useless in a bilevel cir- 
cuit. 


Other factors that raise the voltage level in bilevel circuits *are dio- 
des for BCD encoding electromagnetic noise, the IR drop across connector 
pins, and wire resistance. Therefore,, the number of ohms required to declare 
a switch "failed" is somewhat arbitrary. In this case eight ohms is used as 
the maximum number. 

t 
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I SWITCH ENCODING 

V7 CONTACTS DIODES 


ELECTRO- CONNECTOR WIRE 

MAGNETIC PINS RESISTANCE 

NOISE 


BILEVEL- 
INPUT TO 
COMPUTER 


FIGURE 8.3-33 RESISTANCES OF BILEVEL INPUT LINE 


When the contacts have changed from .010 ohms to 8 ohms the switch has 
had either long and/or hard usage. At TTL current levels (.00125 amps), 
and other normal circuit conditions, the switch is still useful, but it may 
be approaching the maximum (dry) life. expectancy . In higher amperage cir- 
cuits, heating of the contacts will be noticeable and the resistance will 
increase rapidly, therefore the life expectancy is nearing its end in either 
type of usage. 

"Dry" switching is the exercise of the switch when no current is flow-r. 
ing. This action mechanically flexes and strains the springs and the metal 
supports of the contacts. Metallurgists call it "cold working 1 '. At fail- 
ure, the metal cracks and breaks. A switch often will last longer under 
laboratory "dry switching" test conditions. However, when current is switch- 
ed,, so that temperature rises, an unfavorable change in the heat treatment 
condition may occur. Therefore the life rating nearest the actual load con- 
dition is the life span to expect. 

See Table 8,3-21 for a summary of failure modes and related symptoms. 

8. 3. 9. 3 Checkout Techniques and Hardware Requirements 

’ Fully automatic checkout or self test of a toggle switch assembly re- 
quires the capability to sense open or closed switch contacts in response to 
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TABLE 8.3-21 FAILURE MODES 


MODE 

bYM? i ^ 

EXTERNAL 

INTERNAL ! 

Excessive 

Resistance 

"High" resistance 
across a pair of 
terminals 

Burned and pitted 
contacts 

Closed 

Circuit 

Continuity between one 
terminal pair in all ! 
toggle positions 

Welded contacts 

Open 
Ci rcui t 

No continuity between 
terminals in any 
toggle position 

Broken contact 
supports 

Mechanical 

Cannot change state 

Broken spring or - 
detent 


switch toggle movement. However, there is no built-in switch mechanism in 
the Microswitch 2TL1 (reference configuration) to operate the toggle auto- 
matically, i.e., under computer control. 

Such a switch would be equivalent to a relay with a mechanical toggle 
override: no such switch or relay is known to exist anywhere. In addition, 

no known relays of the shape and size of the 2TL1 switch have the three de- 
tent positions like the 350 three-position switches in the reference config- 
uration. This approach is expanded in a later paragraph. ' . 

* 

It is not likely that a simulator switch will fail in the "closed" 

(welded) position as described in paragraph two. Therefore, a possible com- • 
promise is the verification of switches in the closed position. As noted, 
this does not verify that a switch contact can be opened, but this type of 
failure is a very small probability. It also has the time and reliability 
disadvantages that a human operator is required to actuate the switches 
■prior to the test. The first two test techniques are discussed with this 
paragraph's prerequisites and limitations in mind. 
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I Comparison of Contact Voltage Prep 

As noted in paragraph two, there is an IR (voltage) drop across the 
switch contacts. Contact resistance (and voltage drop across the contacts) 
increases with usage. This larger resistance, in addition to the other re-' 
sistance of Figure 8.3-33, raises the voltage at the computer interface to- • 
ward the computer's, threshold voltage of .8 to 2.0 volts for recognition of* - 1 
contact closure. 

If a reference voltage, less than the value of the threshold voltage is 
fed into the V ^ terminal of a comparator such as Fairchild A734 (see Fig- 
ure 8. 3-34, below) , and the switch signal is fed into the V. terminal, early 
warning of switch failure can be detected by monitoring the output voltage 
at V t . For automatic checkout, the' switches can be multiplexed into the 
comparator by MOSFET switches, and V^can be monitored by the computer. 

See software flow diagram in Figure 3.3-35. 

If the switch has not been actuated to the correct position the com- 
parator will give a "failed", output voltage. ' • 

k ~ ' 

- * i 

The pole that controls components such as lights or relays may be 
handled similarly to Figure 8.3-36. However, this can be applied only where 
.the maximum circuit (relay) voltage does not exceed the "highest input vol- 
tage range" and the "maximum differential input" voltage ratings of the com- 
parator, unless protective resistors R1 , R2, and R3 are added. Both limit 
ratings are near V15V for fairchild Semiconductor comparators. The compara- 
tor works similarly to the above circuits, and as shown in Figure 8.3-34. 

Analog Measurement of Voltage Level j 

Figure 8. 3-37 shows how a differential amplifier may be used to measure 
the IR drop across the switch contacts. One circuit is for a switch that 
controls a ground voltage, the other is for a component (e.g., relay coil) 
voltage. The component voltage is limited to the common mode voltage of the 
differential amplifier, which is normally +15 volts DC. Because the switch 
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NORMAL OPERATIONAL 



FIGURE 8.3-34 SWITCH CHECKOUT BY A COMPARATOR ^ 
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FIGURE 8.3-35 SOFTWARE FUNCTIONAL FLOW DIAGRAM 


TYPICAL 
• COMPONENT 



R3<R2 

IF SWITCH IS or, Y ih + < Y ik ‘, - -0‘ VOLTS 

IF SWITCH RESISTANCE IS EXCESSIVE. Vj N + > V IK '. Y ouT BECOMES A “T (V* Y0LT5) 


FIGURE 8.3-36 COMPARATOR CIRCUIT FOR COMPONENT SWITCHING POLE 
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FIGURE_ 8.3-37 ' DIRECT MEASUREMENT OF VOLTAGE DROP ACROSS SWITCH CONTACTS 
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and relay coil may generate destructive voltage spikes, the component voltage 
may be limited to considerably less than the common mode voltage. However, 
protective resistors may be' added as in Figure 8.3-36, so that +28VDC cir- 
cuits may be monitored. A word of caution: if the differential amplifier is 

placed external to the panel on which the switch is mounted it will measure 
voltage drops of additional resistances as shown in Figure 8.3-33. 

. . x . 

Switch Modification For Remote Operation 

Theoretically, a toggle switch may be modified by adding solenoids to 
pull or .push the contacts to the desired position. The action resembles a 
latching relay with a mechanical (toggle) override. .However, the permanent 
magnets of a latching relay would not be required for checkout use. The coil 
can hold the contacts for the short test time required. Two coils per switch 
are required. The three position switch may have a center OFF detent if both 
coils repulse the contacts simultaneously. Neither configuration is commer- 
cially available, nor is it known whether a manufacturer is willing to try, 
or has ever tried, to design such a device. 

Difficulties have arisen with DC relays that switched 120 VAC on pre- 
vious simulators. This condition exists with about one percent of the crew 
station switches. AC voltage spikes were induced on the DC line when the AC 
line was switched at or near the peak of the AC waveform. These spikes have 
been falsely sensed as inputs to the computer and to the- surrounding digital 
equipment. This condition could repeat on this type of switch if suitable 
precautions are not taken. 

i 

Care is required that the toggle actuation forces are not unduly alter- 
ed by the addition of the coils. The modification of a 2TL1 sv/itch to this 
degree is such a drastic percentage change that the part number would change. 
The reference configuration states that 2TL1 switches are used. Therefore, r 
this modified switch, even if available and otherwise useable, does not con- 
form to the constraints of the reference configuration and boundary of the 
study . 
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Remote Switch Actuation • 

Seme means of switch actuation by mechanical action are examined J^elow. 
These techniques do not alter the 2TL1 switch. Although preliminary panel 
layouts are available, many other pertinent details are lacking at this time. 
Some of these details are panel thickness, switch guards, recess depth of 
switches, incandescent' light piping of nomeeclature, spacing between switches, 
and grouping of two and three position switches. Therefore one cannot fully 
evaluate the validity of the proposed approaches that are given. 

The first approach involves a modified cylinder of suitable length. See 
Figure 8.3-38. It encloses the switches and wiring, and protrudes through 
two panel slots per svntch in the trough or recess. The "fingers" that push 
the toggle are stiffened with flutes. The rear of the cylinder is open for 
access to the switch terminals. The cylinder rotates to push all toggles down 
to the lower position. The cylinder reverses to move the toggle to the center 
position, pauses, then raises the toggle levers to the upper position. At 
each toggle position the computer monitors the corresponding bilevel input 
lines for sensing the correct switch function: i.e., open circuit or ground. 

Approximately 100 or more cylinders are required. 

The other approach involves the movement of sections of the panel over- 
lay [for lighted nomenclature] by a linkage. For fidelity reasons, the link- 
age and energizer are behind the panel as shov/n in Figure 8.3-39 • The over- 
lay pieces are reinforced for rigidity and minimum wear on the edges. The 
overlay would move the switch toggle while the comouter monitors the switch 
output similarly to the modified cylinder as described above. 


8. 3. 9. 4 Recommended Checkout Approach 

The candidate techniques are compared and summarized in Table 8.3-22. 

Two techniques have much in common and are close in' cost. They are (1) thres 
hold voltage measurement by comparator and (2) contact voltage drop measure- 
ment by differential amplifier. The favored techniaue is the first one be- 
cause of the simplicity of checking the output of the comparator. 


If fully automatic checkout is required, then the “relay-switch" is 
recommended. 
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FIGURE 8.3-38 MODIFIED CYLINDER ACTUATOR FOR PAIR OF TOGGLE SWITCHES 
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The other approach involves the movement of sections of the panel overlay 
[for lighted nomenclature] by a linkage. For fidelity reasons, the linkage 
and energizer are behind the panel as shown in Figure 8.3-39. The overlay pieces, 
are reinforced for rigidity and minimum wear -on the edges. The overlay would 
move the switch toggle while the computer monitors the switch output similarly 
to the modified cylinder as described above. 



| FIGURE 8.3-39. MOVEABLE OVERLAYS TO OPERATE TOGGLE- 
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SOFTWARE 

REQUIREMENTS 

REMARKS 

Processing of 
discrete data 

GO-NO GO checking external to com- 
puter, Limit changed by hardware 
adjustment. 

Human operafor' to manipulate 
switches . 

Processing 
and evalua- 
tion of 
quantitative 
parameters . 

NO-NO GO checking. Limit changed 
by programming. 

Human operator to manipulate 
swi tches . 

Processing of 
discrete data 

Equivalent of relay with toggle 
override. 

Item not on market. 


Detail design for clearance 
and fit for each location, - 


)I DATE TECHNIQUES • 


1 November 1974 
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8.3.10 Push Button Switches 

There are 75 pushbutton switches in the crew station and another 60 on 
the Instructor Operator Station (I OS) of the Reference Configuration. 

This' section describes various techniques for checking these 135 push- 
button switches in the Shuttle Mission Simulator or.'Other Shuttle simulators. 
One specific technique is recommended, based upon cost and proof of functional 
operation. 

8.3.10.1 Description and Type of Functions Applicable 

The 75 pushbutton switches in the crew station are flight hardware. 

Those in the IOS are not defined as to the number of poles, accessories, or 
vendor; however, all switches have only one discrete output to the computer. 
See Table 8.3-23. Most lighted switches in the crev' station (C/S) are alter- 
nate action (mechanical latchdown). The lighted section is checked by tech- 
niques described in paragraph 8.3.5. 

Typical spacecraft functions that are switched by push button switches 
are computer keyboards, avionics fire protection, and push-to-talk. 

8.3.10.2 Failure Mode Analysis 

Table 8.3-21 lists. the failure modes and related symptoms. Section- 
8.3.9 discusses in detail the various modes of failure and means of detection. 
Briefly, the failure modes are excessive resistance, open circuit, welded 
contacts, and mechanical failures and are similar to toggle switch failures. 

8.3.10.3 Self Test Hardware and Software Requirements 

Automated checkout or self- test of a pushbutton switch, in general, re- 
quires a means for sensing contact closure/opening in response to actuation 
of the pushbutton. 
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TABLE 8.3-23 PUSHBUTTON SWITCHES 


,Input: 0 Vdc (Ground) 

Output: Input voltage' 

Open Circuit 

One pole: one discrete 

Reference Configuration Quantity: 75 in crew station, flight hardware 

60 in-IOS, vendor not defined 

Contact Resistance (new): less than .025 ohms (Gold Contacts of "SM" 

Subminiature switch modules) 

Design Life: 100,000 or more operations for 2D1 module which includes 

two "SM" switches 

Expected Life: Dry - 10 million operations 

Load 1 million operations 

Expected Failure Modes: excessive resistance 

open circuit (broken contact supports) 
closed circuit (welded. contacts) 

mechanical 

Critical Measurement Points: Input/Output Terminals 

Parameters of Concern: contact resistance 


^-11 SMI module 


A pull-in solenoid coil can be added to the pushbutton switch assembly 
and can be remotely operated to cause the switch to change state. See Figure 
8.3-40 for Microswitch Series 2 commercial pushbutton switch with a pull-in 
coil. In the "relaxed" condition, the contacts of a momentary switch are open; , 
in the "actuated" condition, the contacts are closed. Actuation of the solenoid 
of an alternate action switch merely causes the contacts to change to the other 
state. The regular switch circuits to the computer can be used to monitor 
the bilevel condition of the contacts. See' Figure 8.3-41 for a software flow 
diagram. One possible limitation is that the physical diameter of the solenoid 

i 

may exceed the, switch width or height; for example, keyboard switches. In such 
a case, a smaller diameter, but longer coil is required to achieve the necessary 
actuation force. 
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HOUSINGS 

WITH 

FLANGES ON 
SHORT SIDES 

These housings have spring mount- 
ing clips ready-attached to the 
shorter sides. 


Catalog Llitinfi 


Short Flange 

Operator-Indicator Housing Type Ho of Sockets 

Type 2C 

Type 2C200 

No Coil 

2 (A h. C) 

2C10 

2C210 


4 (A. B, C & D) 

2C12 

2C212 

G vdc Coil (Hold-in) 

2 (A & C) 

2C22 

2C222 


4 (A, B C & D) 

2C24 

2C224 

23 vdc Coil (Hold-in) 

2 (A & C) 

2C34 

2C231 


4 (A. B. C'A D) 

2C36 

20236 

43 vdc Coil (Hold-in) 

2 (A £ C) 


2C24S 


4 (A, B C & 0) 

2C48 

2C248 




2C269 




B 

J 

i 


p 



-ASSEMBLY REFERENCE 
PLANE 


( wCt-O-J 

I COIL 


Ki 

■ 


11 

n 

Si 

H 


i 


*AJso available wan Manges on art four sides - 2C7? (Type 2C) 3rd 2C277 (Type ?C200) 


Trail » 

-4 *-,130 

“LAMP TERMINAL DESIGNATION 2 TERMINALS 
FOR EACH LAMP. PLATED FOR SOLDERING 

NOTE — 

A\ INCREASE LENGTH 8Y.020 FOR ITPE 
. 2C200 

^INCREASE LENGTH BY .930 FOR PULL-IN 
COIL 


PUlL-m COIL ELECTRICAL DATA 

(available in Flange mount only) 

- Pull-in coil equipped operator-indicators enable electro- 
I magnetic actuated, maintained and released contacts. 
Energizing the coil pulls in the operating plunger, 
causing circuit transfer in the switching unit. At 28 
vdc, 2.2 amps, (approx) is required during actuation 
(for about 20 MS or less) and only .11 amp. (approx) 
during hold-in. (Recommended for operation at 85 to 
100% of rated voltage.) 

Switch units that can be used are ‘‘TB”, “PL” and all 

• “SM” types except low force ancl 4-pole alternate- 
action designs. See Pages 12-13. Maximum ambient 
temperature limits arc t-120°F (1 •"*.2 pole mo- 
mentary-action), 4-110° F (3-pole momentary-action) , 

1 +100°F (4-pole momentary-action) and +90°F (all 

• alternate-action or momentary/aliernate-action) switch 
units. 

ELECTRICAL BAIL 

The circuit at right shows how any number of Catalog 
Listing 2D162-can be operated in one-by-one sequence. 
Each actuation releases previously actuated switch. 



Power is required only during the reset pulse. (Reset 
can also be accomplished by depressing previously 
actuated screen.) 


ELECTRICAL RATING 


Silver Contacts 

30 vdc - 5 amps res. sea level or 
50,000 ft., 3 amps ind. sea level, 2.5 
amps ind. 50,000 ft.. Max. inrush, 
24 amps. 


UL and CSA listing for basic 
switch: 

125 or 250 vac 5 amps 


Gold Contacts 

30 vdc - 0.5 amp ind., 1 amp res. 
sea level and 50,000 ft., 2 amps max. 
inrush. 


FIGURE 8.3-40 SELECTED VENDOR DATA ON MICROSWITCH SERIES 2 PUSHBUTTON SWITCH 
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;• FIGURE 8.3-41 SOFTWARE FUNCTIONAL ' FLOW DIAGRAM 
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8.3.11 Rotary Switches and Potentiometers 

^ There are 15 rotary switches and 55 potentiometers in the Crew. Station and IOS 
f the Reference Simulator Configuration. This section discusses various techniques 
analyzed for checkout of these components. As stated in Section 8.3.9, the main 
consideration in defining self test techniques for control devices if the method 
of automatic mechanic -actuation of the device. Rotary switches and potentiometers 
are treated here together 'because both of these types of components require cir- 
cular, finger-compatible motion in order to produce the mechanized actuation re- 
quired for self test, and therefore, definition of self test techniques applicable 
to one type of component is useful to the other type. 

8.3.11.1 Description and Applications 

The rotary switch has three to nine positions and non-shorting contacts. See 
Figure 8.3-42 for typical commercial rotary switches and Table 8.3-24 for simulator 
.related data. Data on the flight hardware rotary switches are not available but 
the commercial switches of Figure 8.3-43 have many of the expected features. 

Typical spacecraft functions that are switched by rotary switches are electri- 
ial bus selections for ammeters and voltmeters, fire/smoke detecters, fuel/oxidizer 
pressures. 


TABLE 8.3-24 ROTARY SWITCHES • 

Input: Ground (0 Vdc) 

Output: Open Circuit 
‘ ; Ground (0 Vdc) 

Poles: Same as flight hardware 
One pole per deck 

Reference Configuration Quantity: 15 in crew station 

None in IOS 

Expected Failure Modes: excessive contact resistance 
. welded contacts 

• open circuit 

- "• ' mechanical breakage 

Critical Measurement Points: Input/Output Terminals 
Positions: 3 through 9 except 8 
Contacts: Non-shor,ting 
Life: 50,000 plus mechanical operations 

Contact Resistance: .010 ohms, max., initial 

Dielectric Strength: 800 VRMS between adjacent terminals 

1500 V between active terminal and ground 

. Insulation Resistance: . 10 5 megohms, at 25°C, 502 RH at sea level. 
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miniature rotary switches 


• Up to 12 active positions per deck shorting or non-shorting, with 30° spacing. 

• Shorting AND non-shorting poles may be grouped on one deck in any combination. 

• As many as 6 poles per deck. 

• All individual deck parts are self-contained, and are permanently molded into place. 

• Available with adjustable stops. } 



ELECTRICAL FEATURES 

1. Initial contact resistance — .0100 max. 

2. Current carrying capacity — 5.5 amps. 

3- Current breaking capacities 

Wamp — 115 V.A C. res suve 
V* amp — 23 V D C. -esistive 
amp— 23 V D C inductive. 

A. Dielectric strergtn (voltage breakdown) — 
j. between any two adjacent positions — 800 V 
RMs (60 cycles). 

b. between any active position to ground 1500 V 
(60 cycles). 

5. Insulation resistance (measured at 25°C. 50% RH 
at sea level) — 10 * megenms. 

6. Thermal EMF — 1 micrcvcit/°C maximum. 

7- Capacitance — between adjacent active contacts 
.5 MMFO Max. 

9. Capacitance — between contact and common 
terminal .9 PFD Wax. 

MECHANICAL FEATURES 

1. Life expectancy — in excess of 50, COO mechanical 
operations. 

2- Detent— positive stainless steet roller-type detent 
snaps from positron to position. Detent housing 
■ made of special high-st*engtn oiastic. orovicmz 

. positive action ana minimal wear. 

3. Stop strength — Designed to withstand 10 inch- 
lbs. rotational force. 

4* •'Molded in'* terminals give exceptional terminal 
strength. 

5. Terminal locations clearly marked on rear cover 
plate. 

6. On arty one deck of a rrulti ooie switch, a variety 
Of comb nations cf snorting i.VB8) and non-short- 
ing (B3M) actions may oe ootamed. 

7* Materials and finishes: 

Rotor — Lexan 

Rotor b'ade — Beryllium capper (gold plated) 

Contacts & solaer terminals — solid stiver alloy 

Housing — Oialiyl Pnthalate 

Stator — Diaiiyi Phtr-aiate 

Shaft — stainless steel 

All trass parts mcxei plated 

ft. One piece contact terminal construction has 
holes large enough to accept two *22 AWG wires. 

9. Shaft and panel seal at additional cost nay be 
specified by using prefix "S * before switch type 
numbers. 

10. Explosion proof per paragraph 4 , p. 12 of MIL- 



TOU I'-U ON A LI. FRACTIONAL DIMENSiCS* 



SPECIAL MODIFICATIONS AVAILABLE: . 

All commercial version RCL switches are available with the following features at additional cost: 
• Spring return feature {Series AC, CC and DC only) 

♦ "Push-to-turn" and “puil-to-turn” spring loaded action where an isolated position is required. 
• Shaft and panel seals (specify by using prefix “S" when ordering). 

« Non-standard shaft and bushing lengths. 

• Specially coded outputs, including decimal to binary for digital applications. 

• diameter shaft and ; )s"-32 threaded bushing {Series CC, DC, HC, AC only) 


CONTACT FACTORY FOR COMPLETE SPECIFICATIONS 


FIGURE 8.3-42 TYPICAL COMMERCIAL ROTARY SWITCHES 
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8.3.11.2 FAILURE MODE ANALYSIS _ 

I Failure inodes of switch contacts are discussed in detail in paragraph 

8. 3. 9. 2 .. Failure modes for rotary switches correspond to sunmary in Table 
8.3-21 . 

Failures of potentiometers occur primarily in. worn wiper contacts or a loose 
wiper arm, or worn spots in the film resistor. Initial failures appear as inter- 
mittent high resistance or open circuit. At failure, volume -of communications 
will decrease, or illumination of lights will decrease for the particular 
potentiometer. 

One checkout technique is the addition of an amplifier and special .analog 
circuit to the computer as shown in Figure 8.3-43. Actuation of the potentio- 
meter is the same as the rotary switches. 

8.3.11.3 ‘ Self Test Techniques 

.Fully automatic checkout or self test of a rotary switch requires the 
capability to sense open/closed contacts in response to switch shaft rotation 
«nd the ability to rota-te the shaft automatically; i.e., by computer control. 

Switch manipulation can be accomplished by a motor attached to -rear of switch. 
Measurement of contact parameters, can be accomplished by the following techniques: 

• Compare switched voltage to a reference voltage 
e Measure voltage drop across contacts 
e Direct sensing via computer operational bilevel channels 
The switch manipulation technique will be discussed first, followed by the mea- 
surement techniques. 

Motor Operated Switch 

A small reversible -geared motor can be mounted on the rear of a rotary switch 
or potentiometer. The. switch can be driven to a starting position at one end of 
its rotation, and then through its full arc in the opposite direction. The start- 
ing position and other positions are sensed through the switch contacts. 

The condition of the contacts can be sensed by techniques that will be dis- 
cussed later. 

REFEODUCIBILITY OF THE 
ORIGINAL PAGE IS POOR 
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LIGHTING 

OR 

VOLUME 

CONTROL 



(ADD) 


FIGURE 8.3-43 POTENTIOMETER CHECKOUT TECHNIQUE 
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Sensing Techniques - Comparison of Contact Voltage Drop 

^ As noted in paragraph 8. 3. 9. 2, there is an IR (voltage) drop across |the 
switch contacts. Contact resistance (and voltage drop across the contacts) 
increases with usage. This larger resistance, in addition to other circuit 
resistances, raises the voltage at the computer interface toward the computer's 
threshhold voltage of .8 to 2.0 volts for recognition of contact closure. 

If a reference voltage, less than the value of the threshhold voltage-, is 
fed into the V re - terminal of a comparator such as Fairchild uA734 (see Figure 
8.3-44), and the switch signal is fed into the V^ n terminal, early warning of 
switch failure can be detected by monitoring the output voltage at V For 
checkout, the switches and individual contacts can be sequenced into the com- 
parator by one of the methods previously described and V QUt can be monitored by 
the computer. See software flow diagram in Figure 8.3-45. 

If the switch has not been actuated to the correct position, the comparator 
will give a "failed" output voltage.- 

i 

A pole that controls components such as lights or relays may be handled 
similarly to Figure 8.3-46. However, this can be applied only where the maximum 
circuit (relay voltage does not exceed the "highest input voltage range" and 
the "maximum differential input" voltage ratings of the comparator, unless pro- 
tective resistors R1 , R2 and R3 are added. Both limit ratings are near £15 V 
for Fairchild Semiconductor comparators. The comparator works similarly to the 
above circuits, and as shown in Figure 8.3-44. 

Analog Measurement of Voltage Level 

Figure 8.3-48 shows how a differential amplifier may be used to measure the 

IR drop across the switch contacts. One circuit is for a switch that controls 

a ground voltage, the other is for a component (e.g., relay coil) voltage. - 

The component voltage is limited to the common mode voltage of the differential 

* 

amplifier, which is normally £15 volts DC. Because the switch and relay coil 
may gemerate destructive voltage spikes, the component voltage may be limited 
to considerably less than the common mode voltage. However, protective resistors 
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SWITCH 

UNDER 

TEST 


NORMAL 
•OPERATIONAL 
BILEVEL INPUT 
TO COMPUTER 


COMPARATOR 


v THRESHHOLD 

(adjusted for 
IR drop across diode) 


BILEVEL GO/NO GO 
TEST SIGNAL TO 
COMPUTER 




warn 




COMPARATOR 




BILEVEL GO/ NO GO 
TEST SIGNAL TO 
COMPUTER 


THRESHHOLD 


EQUIVALENT CIRCUIT I 

FIGURE 8.3-44 COMPARISON OF CONTACT VOLTAGE DROP 
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FIGURE 8.3-45 SOFTWARE FUNCTIONAL FLOW DIAGRAM 
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^y be added as in Figure 8.3-44 so that +28VDC circuits may be monitorec^. A 
word of caution: if the differential amplifier is placed outside the switch's 

panel, it will measure voltage drops of additional resistances as shown in 
Figure 8.3-33 in Section 8.3.9 . 

Operational Computer Input Signals 

This technique adds no circuitry to the simulator. The program checks the 
regular bilevel computer inputs for functional operation. Since there are few 
switches and switch contacts, contact resistance and suspected failures can be 
economically checked by technicians on an "as required” basis when the computer 
senses a failure. 

A comparison of these techniques is shown in Table 8.3-25. 

8.3.11.4 Hardware and Software Requirements 

It is recommended that the switches be cycled by means of a small motor 
-ttached to the rear of the rotary switch. 

It is further recommended that the contact condition be checked by the • 
operational bilevel computer input signals. 
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- • TYPICAL 
COMPONENT 



UA734 


'IF SWITCH IS OK, V IN + < Vj N ", V 0UT = ‘"0" VOLTS 

IF SWITCH RESISTANCE IS EXCESSIVE, V JN + > V IN ", V QUT BECOMES A "1“ (V+ VOLTS} . 
FIGURE 8.3-46 COMPARATOR CIRCUIT FOR COMPONENT SWITCHING POLE 
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• -FIGURE 8.3-47 DIRECT MEASUREMENT OF VOLTAGE DROP ACROSS SWITCH CONTACTS 
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CANDIDATE 

TECHNIQUES 

RELATIVE ' 
COST 

HARDWARE MODIFICATIONS 

SOFTWARE’ 

REQUIREMENTS 

V 

REMARKS 

MODS TO 
SWITCH 

’ ADDITIONAL MODS 
TO EQUIPMENT 

MOTOR 

OPERATED 

SWITCH 

MODERATELY 
LOW _ 

ADD SMALL MOTOR TO 
REAR OF SWITCH 

V 

» 

ADD ON/OFF, DIRECTION,' 
SEQUENCING CONTROLS . 

1 * 

1 

! 

PROCESSING OF 
DISCRETE FEED- 
BACK DATA. 
MULTIPLEXING 
OF OUTPUT 
SIGNALS TO 
MOTOR OR TO 
ROBOT. 

SELECTED TECHNIQUE 

THRESHOLD 

VOLTAGE 

COMPARATOR 

MODERATE ' 

NONE 

i 

ADD COMPARATOR, V R £p*, 
ISOLATION DIODES . ' 

PROCESSING OF 

DISCRETE 

DATA 

GO/NO GO CHECKING EXTERNAL TO 
COMPUTER. LIMIT CHANGED BY 
HARDWARE ADJUSTMENT 

ANALOG 

VOLTAGE 

DROP 

MEASUREMENT 

MODERATE 

NONE 

ADD DIFFERENTIAL 
AMPLIFIER 

PROCESSING AND 
EVALUATION OF 
QUANTITATIVE 
PARAMETERS 

GO/NO GO CHECKING. LIMIT 
CHANGED BY PROGRAMMING 

OPERA- 
TIONAL/ ' 
INPUT 
SIGNALS 

LOWEST 

COST 

NONE ' 

NONE 

PROCESSING OF 

DISCRETE 

DATA 

SELECTED TECHNIQUE. 

USE EXISTING BILEVEL LINES 
TO COMPUTER 


TABLE 8.3-25 CHARACTERISTICS OF CANDIDATE TECHNIQUES 
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3 # 3 J2 Throttles, Hand Controllers, Rudder Pedal's 

- This section deals with control devices that are physically larger than 
finger activated controls such as toggle and pushbutton switches, and which 
normally require the range of force that can be supplied by an operator's hand 
of foot. Included in this type of controllers are throttles, hand controllers, 
rudder pedals, and speed brake control levers. Some of these devices generate 
analog signals proportionate to the force applied or amount of deflection. 

Others generate discrete outputs that only notify the controlled subsystem as 
to the direction of the desired change. 

8.3.12.1 Hardware Description 

Basically, all of these devices transform mechanical inputs from the crew- 
man into electrical signals for vehicle subsystem control. Motion of the 
handle or pedal is monitored either by continuous position sensors, such as a 
potentiometer, or synchro/resolver arrangement, or by discrete switches that' 
indicate the direction of motion without information as to the amount of deflec- 
tion of the controller. In the first case, an analog signal is generated to the 
jOST computer, through the DCE. This signal is then used to determine velocity 
of change or whatever parameter is related to the controller motion in the 
affected subsystem .math model,. and thereby to determine the course of the simu- t 
lation sequence. In the second case, the discrete information, also routed to 
the HOST through the DCE, is used to determine direction of change in the sub- 
system affected. 

8.3.12.2 Failure Modes and Characteristic Parameters 

Failure modes and characteristic parameters for sensors used in the various 
controllers discussed here have been discussed in previous sections of this report. 
Table 8,3-26 shows the type of sensor that may be encountered in each type of con- 
troller and correlates these sensors to the section that dealt with the self test 
analysis for that type of sensor. 
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) 

„JNTR0LLER type 
t-hrottles 

HAND CONTROLLERS 

RUDDER PEDALS 
CONTROL LEVERS 


TABLE 8.3-26 CONTROLLER MOTION SENSORS 


SENSORS 


SENSOR SELF TEST ANALYSIS 


Potentiometers 
Synchro/Resol vers 


Section 8.3.11 
Section 8.3.4 


Discrete Switches 
Potentiometers 
Synchro/Resol vers 


Section 8.3.9 and 8.3.10 
Section- 8.3.11 
Section 8.3.4 


Potentiometers 

Synchro/Resolvers 


Section 8.3.11 
Section 8.3.4 


Discrete Switches 
Potentiometers 


Section 8.3.9 and 8.3.10 
Section 8.3.11 


It should be noted that, although the synchro/resolver analysis in Section 
8.3.4 deals with display devices, the concepts discussed also apply to controllers 
in that the components involved and their characteristics are very similar. Only 
the direction of information flow is reversed, but, in both cases, an electrical 
signal is generated which is indicative of desired mechanical motion. 


An additional source of failure applicable to the controllers discussed 
here is the possible mechanical linkage that would prevent motion of the con- 
troller or that would cause an improper signal to be generated for a particular 
motion of the specific controller. 

8.3.12.3 Self Test Techniques 

Self test considerations for these controllers are very similar to other 
control devices discussed previously, in that the primary requirement is to 
develop an automatic, calibrated means for control activation. Development of 
servo systems to actuate the controls is a relatively simple control design 
problem. The packaging problems are, of course, unique to each simulator to 
which they are applied. Although there is no substantial area for development 
of self test techniques for these devices, it should be noted that the basic 
types of concepts shown in subsection 8.3.9 for switch actuation could be adapted’ 


8-186 


MCDOMNEEU DOUGLAS ASTRO/V/S UTICS COMPANY <* EAST 



• MDC-E1150 
1 November 1974 

to several types of control actuation and, with proper servo drives, could' 
also be used for calibration. Calibration is a requirement even for manual 
testing of these devices and may, in some cases, require special hardware for 
this purpose. 

Implementation of simple servo systems for control actuation presents no - 
unusual problems. The packaging peculiarities of specific simulators 'are not 
an opportunity for development of generic self test techniques either. Conse- 
quently, analyses of the control actuation problem have not been extended any 
further than the- discussion above. 

8.3.13 Crew Ststion/IOS Controls and Displays Self Test Summary 

The results of the analyses of self test techniques for the controls and- 
displays in both the crew station and the instructor/operator station are 
characterized by the following properties: 

o The display instruments or control devices are the lowest level to- 
which fault detection and isolation is intended to be carried in an 
automatic or self test mode. Effectively, there is only a require- 
ment to test for -proper functioning of each device. There is no need 
for further fault isolation testing. 

o In most instances modifications are required to the display instruments 
in order to implement a technique for sensing display instruments 
■performance. This requirement for instrument modification creates a 
need for implementation of desired self test facilities during simu- 
• lator development, rather than after delivery and acceptance.- 

o Actuation of control devices does not necessarily require any modifica- 
tions of the devices themselves, but the necessary actuation equipment, 
must be designed for compact stowage and concealment from the trainees. 

o Data base requirements can be substantial because of the number and 
variety of devices include in the controls and displays area. See the 
following subsection for a summary of the data base requirements. 
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o The results of the present analysis represent self test techniques or 
approaches that may or may not be necessary for a specific simulator. 
v The value of implementing any of these techniques depends on specific 
simulator requirements and other factors that are outside the scope 
of this study. 

The implementation of the various control and display tests described 
requires a test executive to- control and integrate the various component tests. 

The configuration' of such an' executive is discussed briefly in the following 
section. The overall data base requirements for the crew station and IOS are 
surnnarized in subsection 8.3.13.2. 

8.3.13.1 Crew Station/IOS Test Software. 

The software flow for an integrated crew station/instructor operator station 
test software structure is presented i.n Figure 8.3-48. The software modules 
called out by the crew station test module, CSTST, omit .addressing requirements 
for communicating test signals out as well as for reading test results into the 
computer. * Addressing requirements are dependent on the particular hardware con- 
juration being considered and computer word sized, byte addressing capability,, 
etc. The data base impact of addressing requirements even for the large number 
.of ’instruments and controls in the crew station subsystems are negligible com- 
pared to the basic data that must be stored with respect to instrument performance. 

The summary of the data base requirements for the crew station display and 
control test software are summarized in subsection 8.3113.2. 

8.3.13.2 Test Software Data Base Impact 

An initial estimate of the data base requirements for the test software and 
data to support a self test capability for a Shuttle simulator is presented in 
Table 8.3-27. The estimates shown assume that instruments in the IOS are dupli- 
cates of the instruments in the crew station and no additional data storage is 
allocated fo the IOS instruments. In the case of discrete equipment such as 
indicators or toggle switches, it is assumed that any data required will be sub- 
merged in the context of the test software and will be extremely minor in amount. 


8-188 


MCDO/V/VCLL DOUGLAS ASTTKONAUTTICS COMPANY - EASY 



, MDC Ell 50 
| 1 November 1974 



..EIGURE 8.3-48 ..CREW. STATION TEST SOFTWARE lEEDfi^OSSjESBlLITY OF THE 

' g _ 18g , ORIGINAL PAOF t S por>p 

MCDOfiJNEL.L. DOUGLAS ASTRONAUTICS COMPANY • EAST 




MDC Ell 50 
1' November 1974 


The test software and data base for the crew station and IOS can be cen- 
tered the section of the test software that will be most susceptible to impact 
_y changes in the simulator configuration. Changes in the numbers of instruments, 
the type of instrument, or the arrangement of the instruments will impact the 
locations in the data base in which test values are stored as well as the magni- 
tudes of the test parameters. 
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_ TABLE 8.3-27 CREW STATION TEST SOFTWARE DATA BASE IMPACT 



- 

SOFTWARE REQUIREMENTS 



- "INSTRUCTIONS 

FLOATING POINT 



(NO. OF) 

DATA WORDS 

COMPONENTS 

NO. OF UNITS 


(NO. OF) 

GALVANOMETERS 

70 

300 

630 

DC SERVO DRIVEN METERS 

36’ 

• ' 

324 . 

ADI AND HSI 

4 

' J 100 

no 

LIGHTED INDICATORS 

700 

■ 


BILEVEL FLAGS 

400 



i'GGLE SWITCHES 

600 

100 


PUSH BUTTON SWITCHES 

■'75 



ROTARY SWITCHES 

15 



POTENTIOMETERS 

55 


55 

MISCELLANEOUS CONTROLLERS 

NEGLECTED ■ 



TOTALS 


500 

1119 
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8.4 VISUAL SIMULATION SUBSYSTEMS 

The, extent and complexity of visual simulation equipment required for 
^future manned spacecraft, as typified by the Shuttle, can be readily inferred 
from schematic representations of the various crew members fields of view as 
shown in Figure 8.4-1, (a), (b), and (c). This information was obtained from 
Reference 8.4-1. The pilots and commanders views are the most demanding 
because of the variety of scenes to be displayed, the required fidelity, and 
the wide fields of view in the horizontal plane. 



FIGURE 8.4-1 SHUTTLE ORB I TER CREW STATION FIELDS OF VIEW 
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COWAHDERS 
WHOSHIELD- VISION 
(PILOTS WINDSHIELD 
IS SIMILAR) 


THPU BLKD WINDOW 
(OH OPSIT PILOTS VIEW IS 
SIMILAR) 



FIGURE 8.4-1 SHUTTLE ORBITER CREW STATION FIELDS OF VIEW (continued) 
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In the following analysis of self-test techniques for visual simulation 
^equipment, we have emphasized those particular devices, concepts and systems 
v most appropriate to Shuttle visual simulation requirements. The Reference 8.4-2 
study concluded that these requirements necessitate a TV/model system for the 
forward crew station with a CRT display viewed through infinity optics. CGI 
techniques may be appropriate for certain scenes for the other stations. 

The visual simulation equipment can be divided into several major sub- 
systems which present their own peculiar set of checkout problems. Visual 
simulation subsystems considered for this analysis consist of the following: 

o Image generation equipment 

o Image transmission system 

o Display equipment 

For purposes of this study, we will draw the line between these subsystems in 
such a manner as to best group together those hardware tests requiring similar 
^techniques. Thus, we include the TV camera positioning servo drives and optical 
)probe alignment tests with the image generation equipment analyses. All of 
the TV system electronics and the electrical performance of the camera tube 
are included in the image transmission system. In the display equipment, we • 

' consider only the CRT and the display optics. 

In order to implement simulator self-test techniques, it is necessary to 
establish data paths to the host computer for test initiation, test signal 
generation and data acquisition. This is readily accomplished for the TV 
system electronics which can then be used, in conjunction with the camera, 
to monitor alignment and servo response parameters for the image generation 
equipment. Consequently, .in this analysis, we will address first the self-test 
. technique for the TV system electronics. Section 8.4.1, which comprise the 
image transmission system. In Section 8.4.2 we discuss the problems peculiar 
to the Display System, and in Section 8.4.3, we discuss the image generation 
equipment. The overall integrated visual system test approach is summarized 
in .Section 8.4.4. 


8-194 


M CD OM ME ILL. DOUGLAS ASTFTOWAUTICS COM F*AMY - EAST 



NUL 1 1 l-DU 

1 November 1974 

■k 

8.4.1 Image Transmission System Self Test Techniques 

\ In order to address the problems and techniques for self test of the three 
y 

sections of the visual simulation hardware, it is necessary to develop a more 
detailed description than that provided by the schematic of Paragraph 5.2.6. In 
the instance of the image transmission system, this requires further assumptions 
with regard to the nature of the hardware expected and subsequent consideration 
of the impact of alternate simulation hardware approaches on the application of 
the self test techniques proposed. Consequently, in this discussion of self test 
techniques for a closed circuit TV (CCTV) system for image transmission in the 
simulator visuals, we will address the following topics: 

o CCTV system description 

6 Test Techniques 

o Test Hardware 

o Test Software 

) 

o Incipient fault detection and data base impact. - 

8. 4. 1.1 CCTV System Description 

A schematic of the video circuits and opto/electronic interfaces, as well 
as the interface to the simulator computer, is shown in Figure 8.4-2. Signal 
paths associated with the servo drives for camera positioning," probe controls, and 
model motion have been omitted and are considered in the following section on 
scene generation equipment. This configuration essentially represents the video 
components of the visual simulation equipment previously discussed. 

The major unit functions may be summarized as follows:- 

o Signals for controlling TV cameras are supplied by the camera Control 
Units (CCU). Signals such as vertical and horizontal sweeps, blanking, 
focus control, and beam controls are contained in these lines. 

The formation of the analysis of television test requirements and techniques 
and the use of the Digital Processing Oscilloscope was suggested by Lawrence 
W. Lockwood of Lockwood Associates, Houston, Texas. 
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o Under external computer control, the camera switching unit selects the 
appropriate earth model video signals required for the particular phase 
of the Shuttle mission. The basic scene element video signals of earth 
and cloud/sky are then supplied to the TV Keying and Video Processing 
System. 

o The TV Keying and Video ‘Processing System accepts the basic video signals 
of earth video, cloud/sky video, terrain video, etc., and performs the 
appropriate processing to obtain composite scene video with the appro- ■ 
priate image insetting and special effects for realistic simulation of 
the out-the-window scenes. Certain special effects require computer 
• inputs for gain control. 

o The Display Switcher under computer control routes the composite scene 
video to the appropriate display units of the crew training station. 

v 

|f 

' In order to address the self test of the video system, it is necessary to 
establish more specifically the functional aspects of the configuration assumed. 

These functional factors are derived from previous studies. Reference 8.8-1, of 

% 

Shuttle simulator visual simulation requirements and techniques. The most signif- 
icant requirements are those for color in the visual simulation as well as for 
a wide field of view, 120° to 140°. 


A. widely used means of generating color TV images involves the use of di- 
chroic filters to separate out the primary colors (red, green, and blue) from 
which the color image may be reconstituted. This is accomplished most directly 
in RGB systems (Red, Green,. Blue) as shown in Figure 8.4-3, The three colors 
are separated out by filters. The camera tubes each effectively process a black 
and white image. The images are recombined to produce color in the display tube. 
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| ; ' FIGURE 8.4-3 .TYPICAL RGB SYSTEM SCHEMATIC 
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There is no encoding of the chrominance (color qualities) onto a. subcarrier. Such 
an encoding is unnecessary since the signal containing the color does not have to 
be compressed into one channel for broadcast. Thus each "color" TV channel, is 
effectively a separate black and white TV chain. In essence the verification 
- techniques used for each of the TV electronics chain (R, G, or B) can then be the 
same as for a black and white (B & W) TV system since the video signals have no 
^coTor qualities. 

I ' . 

There are several factors which should be noted with respect to implementa- 
tion of the above concepts. These are, first, the -1 imitations on the probe/camera 
interface and secondly, the alternate color coding systems available. 

The optical /electronic interface between the- scene generation equipment .and 
the image transmission system involves the interface between the optical probe, 
mounted on the TV camera, and the camera tube configuration. Figure 8.4-4 pre- 
sents schematically the functional elements of an artuculated probe as required 
for the Shuttle visual simulation. Reference 8.4-3 describes the only available 
articulated, optical probe with an adequate field of view, 140°. An "articulated" 
probe has the rotational degrees of freedom required to generate views reprea 
senting spacecraft motions in pitch, roll and yaw. Figure 8.4-5 presents a possible 
configuration' for an interface with a single RGB camera. 

Although the probe described in Reference. 8.4-2 has a 140° field of view, it - 
also has a limited effective aperature. This means there is a relatively limited 
mount of light transmitted through the probe. However, the 140° from the 

probe. may be split into three narrow beams (40° to 45° each, each of which is 
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FIGURE 8.4-4 SCHEMATIC DIAGRAM OF ARTICULATED OPTICAL PROBE 

(SIMULATES SPACECRAFTS THREE ANGULAR DEGREES OF FREEDOM) 


t " 


i- 

I 


t* 


IMAGE ROTATER 
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articulated, optical probe rcb tv camera 


FIGURE 8.4-5 • AN OPTICAL INTERFACE OF OPTICAL PROBE AND RGB CAMERA 
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directed.. to_.a. separate- TV- camera- in order to achieve greater resolution. If 
an RGB system is implemented, each of. these would require additional splitting 
into three component colors. Consequently, in a three camera system, the 
availability of light at the camera tubes, for achieving the required image 
quality, becomes a problem. The alternatives are reduced requirements for color 
fidelity; reduced field of view and/or resolution requirements; or use of 
alternate color encoding schemes. 

The color coding scheme proposed in Reference 8.4-4 enables coding of the 
color information with a single tube but with a reduction in color quality. 

Reference 8.4-5 graphically sunmarizes the various single and multiple tube 
color systems in common use. In either case, the major consideration with respect 
to the objectives of this study is that the signals of closed circuit TV systems 
using any of these concepts are essentially similar to closed circuit black and 
white TV signals. Consequently, although the test requirements and techniques may 
require some modification or extension, they are, nevertheless, characteristic of 
QCJ\I .systems which may be incorporated in future visual simulations. 

8. 4. 1.2 Characteristic Parameters and Test Signal Requirements 

Over many years of TV development, various TV test signals have been developed 
and applied to test specific TV parameters. For the present analysis, it is not 
practical to identify all of the parameters that are likely to be of interest since 
these will be -dependent in part on the characteristics of the particular systems 
that are developed. However, it is possible to identify certain basic parameters 
which are very likely to be measured quantitatively if a self test concept is 
implemented and to then establish the test signal requirements for measuring these 
parameters. 

The characteristic parameters to be considered for this discussion are 
sunmarized in Figure 8.4-6 along with the TV system units that they are applicable 
to. It should be noted that the switching devices have been omitted from the 
list of units since verification of proper switching imposes no unique require- 
ments in this specific case of the closed circuit TV system. It should also be 
k noted that the parameters characteristic of the camera optics and the display 
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tube optics are also appropriate for implementation of an end to end' check, 
beginning and ending with an optical display or image. Similarly the electrical 
parameters characteristic of the electronics may be used for an end to end - 
electrical check. 


The various characteristic parameters shown in this case represent either 
performance criteria or symptoms of malfunctions. The number of components in 
a TV signal chain is so numerous that it is not really feasible to consider- the 
ramifications of failures of each of them. Consequently, the approach taken in 
this one instance is to select those characteristic parameters that have 

evolved as indicators of proper' or faulty performance. 


The characteristic parameters are discussed briefly below with reference to 
the typical test signal shown in Figure 8.4-7. This signal represents one line 
of the TV image. The parameters may be described as follows: 

(1) Voltage (Peak to Peak) 

(a) The composite voltage is measured from peak white of the video (top) 
to the peak bottom of the sync pulse. Figure 8.4-7. 

(b) . Video voltage is measured from peak, white of video (top) to the 

blanking level. 

(2) Setup is an arbitrary "setup" of the downward going black video peaks 
above the sync, level in each of the test signals shown. "Setup" values 
have ranged during black' and white and color TV standards development 
from approximately 7.5$ to 10$ of the top of the sync pulse to 100% 
peak white video. The precise amount of setup will be determined during 
design phase. Setup prevents any accidental excursion of black picture 
information into sync, level interfering with the syncronization and 
also gives a little leeway in the brightness control setting on the 
display so that full black can be produced without the possible danger 
of seeing any artifacts of sync. 
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(3) Resolution for test purposes refers to horizontal resolution since the vertica 
resolution is fixed by the number of scan lines for which- the- system- is de- 
signed. Resolution is synonymous with frequency response- since- any degrada- 
tion in high frequency response degrades the number of vertical lines which 
• may be resolved. . . - 


(4) Gamma is the exponent of the power law which is used to approximate 
the curve of. output magnitude versus input magnitude over the region 
of interest, Gamma is usually applied to a camera tube, relating 
input luminous flux to output voltage but can also be applied to any 
TV video circuit (Reference 8.4-6). , - 

In engineering practice i-t is usual to plot input-output charac- 
teristics in linear units, e.g., foot-lamberts and volts. The general 
transfer function, in linear units, is . . 



where Q q is the output quantity resulting from the input quantity Q^. , 
K is a factor relating the scales of the two quantities, and the 
exponent g is called the gradient or gama 

In simpler but much looser terms, gamma appears as though it 
were contrast. The steeper the curve, the more contrasty - the more 
black and white - the picture appears. The less steep the curve, 
the more "washed out" or grayish the picture. 

(5) The signal to noise ratio is commonly defined as the ratio of the peak 

to peak of the video signal to the peak to peak noise. The ratio is 
commonly expressed in decibels. - - - . - 

(6) Differential gain is the difference in gain at high signal levels 
as compared to the gain at .low signal -levels. 

.(7) ...low-frequency streaking appears as the slow recovery to zero amplitude 
of the video signal following a very sharp drop or rise in signal level. 
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(f) Display Image of 
Window Signal 


FIGURE 8.4-8 TV TEST SIGNALS AND THEIR IMAGES ON THE DISPLAY 
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(g) Horizontal Line of Linearity Test Signal 



(h) Display Image of Linearity Test Signal 
FIGURE 8.4-8 TV TEST SIGNALS AND THEIR IMAGES ON THE DISPLAY (Continued) 
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(8) High frequency ringing appears as decaying high frequency transient 
oscillations following a sharp signal level step up or down. 

> • • -i 

(9) Linearity is a characteristic parameter for the camera and for the CRT's 

in the display. Linearity is measured by the capability of either the earner; 
tube or the CRT to represent equally spaced lines or dots with an accurate 
representation of their spacial positions in any area of the image field. 


(10) Registration is the capability required in a multi-image system, 
such as an RGB system, to superimpose the images with a high degree 
of coincidence. Lack of registration is quite often evident in 
color pictures printed in newspapers where the images printed with 
different colored inks do not coincide. Convergence is the related 
property of the multi -beam CRT tube. Again coincidence of the 
component images is the characteristic being assessed. 


Over many years of TV development, various TV test signals have been 
'-^eveloped to measure these parameters and others. The tests shown in Figure 8.4-8 
-4re sufficient for measuring all of the above parameters in most instances by 
reference to the displays of a single line as produced on an oscilloscope. Before 
addressing self test techniques for the TV system it is therefore of interest to 
note briefly how the parameter measurements can be obtained from these test signals. 


(1) Peak to Peak voltages are readily measured from the oscilloscope 
trace of an infinitely repetitive signal such as the stair step or 
the multi-burst. (See Figure 8.4-7). 

(2) Set-up voltage is readily measured in a similar manner. (See Figure 
' 8.4-7). 


(3) Resolution can best be measured using the multi burst signal shown in 
Figure 8.4-8(c). The image it produces on -a -display -is seen-.in-.-Figure 
8.4‘-8(d). As is seen this signal is-. a -series -of -short-bursts -of -signals 
increasing in frequency with each- burst / -- -hence-"multiburst". In 


8-207 


MCDONMEEL. DOUGLAS ASTJFTO/VAUTiCS CO/VIBa/VV* EAST 



MDC El 150 
1 November 1974 


essence this signal produces a sweep generator for the frequency 
span indicated and at a sweep rate of once per horizontal TV scan line.' 

Quite normally the upper frequency bursts will decrease in amplitude 
after passing through the unit under test. Actually, the downward roll 
off of the envelope of the test output of the multiburst signal is the 
frequency response curve of the unit under test. Since the frequency 
response bears a direct relationship to the resolution, the latter is 
easily obtained. 

Gamma is readily measured using the stair step signal. An illustration 
of gamma degradation is shown in Figure 8.4-9. It may prove more accurate 
to use a linear ramp instead of a stair step for the gamma measurement. 

The final determination can be made during test development. 

Measurement of signal to noise ratio in a video signal is a relatively 
difficult problem. The presence of sync. and blanking pulses and noise 
at frequencies outside the frequency range of the video system makes 
direct repetitive measurement difficult. The problem has been solved 
in a specialized metering system produced by Rhode and Schwartz, Ref- 
erence 8.4-7. This unit contains the necessary processing, including 
filters, for obtaining accurate ( .1-.2 dB), repeatable values for 
signal to noise ratio. 

Differential gain is measured with the use of the stairstep. It is 
the difference in gain between different steps - usually measured as 
a partial differential gain between the top most and the bottom steps. 

It might be parenthetically added here that if the gamma has been ob- 
tained the partial differential gain information already has been 
obtained (but not reduced to the parameter as explained above). There- 
fore, this quick and simple measurement provides the information for 
use in analysis. 

Low frequency streaking and high frequency ringing can be measured by 
the use of the window signal (Figure 8.4-8(e)). The image it produces 
on a display is seen in Fig. 8.4-8(f). A low frequency streaking 
is measured as the offset from zero amplitude of the video following 
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the window - or the slow recovery to zero from a falling signal with a 
sharp downtime. .Other factors can be measured with the window signal 
such as tilt, i.e., how flat is the top of the window signal which in 
turn is a measurement of the DC response. It is apparent that- high 
frequency ringing will also present itself for measurement on the sharp 
rise. and fall times. 

Camera linearity appears as the reproduction of- equidistant points or 
lines in a test chart on which the camera is focused, as equidistant 
voltage spikes in the camera output signal. Display linearity is 
perceived as the equidistant spacing of the lines or points in the 
display field as a result of equidistant voltage blips in the 'signal 
fed to the display. The test pattern in Figure 8.4-8(h) can be used 
to test camera linearity. 

(10) The registration of the three cameras in an RGB system can also be 
tested with the pattern of Figure 8.4-8(h). Superposition of the 
line trace from the cameras focused on this pattern can be used to 
measure registration errors. The signals generated by such a 
pattern can be applied to a color CRT to test for convergence of 
the three beams. 

These ten parameters have been measured for TV systems for years by the 
use of a standard generator of the signals described and a trained operator 
interpreting their readouts on an oscilloscope. Such a standard TV test 'signal 
generator (or one modified to accommodate the upgraded TV requirements for 

„ * i 

simulation visuals, i.e., line scan rates, bandwidths, etc.) can be readily 
obtained. However, since these visuals tests are intended to be as fully 
automatic as feasible, the elimination of the operator/interpreter is desireable. 
An automatic test/validation of a complicated color TV Visuals system such as 
required in simulation/training would be much more rapid and accurate then with 
a human interpreter "in the loop". It would also facilitate storage of measure- 
ment data for day to day, and week to week comparisons for purpose of incipient 

fault detection. 

* 


i . 
(9) 
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8. 4. 1.3 TV System Self Test Techniques and Hardware Requirements 

In order to implement, a self test concept for the TV system, it is necessary 
^;o sample the response signal produced by use of standard test signals, previously 
discussed, and digitize these samples for processing by digital computers. The 
A/D channels nominally available in the simulator DCE are wholly inadequate for 
the problem, the magnitude of which can be revealed by looking at a few critical 
parameters. 

The nominal bandwidth of broadcast quality TV is approximately 5 mHz. In- 
creased resolution requirements for visual simulations and the use of a 900 
line system can easily, increase the required bandwidth to 20- mHz. For the 
multiburst test the highest frequency burst represents nearly the bandwidth of 
the system. Sampling theorems require at least two samples per cycle to communicate 
the information present at a given frequency. This would require a 40 mHz D/A 
conversion rate which is well beyond the state-of-the art in A/D equipment. 
Consequently, an alternate means must be found for acquiring the data necessary 
for analysis. 

f Since the TV scan lines generated by test patterns or test signal- generators 
'are repetitive wave forms, sampling can be spread over several cycles or repeti- 
tions of the wave form, thus reducing sampling rate requirements drastically. 
Alternately, the data could be acquired from a single sweep or line by transient 
analysis techniques which might involve multiple parallel sample and hold 
amplifiers as well as parallel A/D converters. Obviously, the second approach 
would require hardware for the data acquisition function that would produce 
no added insight into the problem when dealing with repetitive signals. Con- 
sequently, the approach taken for the present study has been to explore the test 
capabilities available with current state-of-the-art oscilloscopes because of 
their basic applicability to repetitive signal analysis. 

An additional capability available with oscilloscope^ systems that is par- 
ticularly useful when working with TV test signals is the ability to select 
segments of a line sweep for further processing without having the data distorted 
by blanking signals or sync pulses. In particular, the processing of the multi- 
burst is highly simplified since the amplitude response of each frequency burst 
y be measured directly by changing the gating for the test signal. 
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The-gating capability of the oscilloscope may be used to eliminate the. 
blanking and sync pulses when making signal to noise ratio measurements. 
^However, the broad bandwidth of the oscilloscope may create problems byj 
detecting noise signals outside the video transmission range. Since these 
•signals do not affect TV system performance, they may contribute to unrealistic 
or irregular noise figure measurements. Should this be the case, a specially 
designed noise meter with the necessary filters, such as the Rhode and Schwartz 
type UPSF, may be required. The UPSF has an oscilloscope output which would 
permit it to be tied in to the data acquisition system for the other tests. 
Further information on the Rhode and Schwartz metering system may be found 
in Reference 8.4-7. 


Currently, there is only one oscilloscope- available commercially, that 
incorporates or provides the necessary. A/D.-hardware..and..buffer,mempry re- 
quired to interface signal measurements with digital computing equipment.' 
Typically, however, when one system of this type is introduced, additional 
systems are likely to follow, and -the -initial . manufacturer may-be.-expected 
to come out with further variations, on hi s. . own- Biodel.<.in< order-, tov-more-effi- 
Yciently tailor his system to- specific applications. . For. purposes- of- this 
study, we will discuss the presently avail able- system and how.it can be 
introduced into the visual -.'simulation system- to implement, sel f- test ca- 
pability. 

Tektronix has recently introduced a new system based on a unit that is 
called the Digital Processing Oscilloscope or DPO, References 8.4-7 and 8.4-8. 
Figure 8.4-10 is a photograph of a stand alone system incorporating the DPO 
and using a dedicated DEC PDP 11 as the computer for the system. The Tektronix 
DPO has several key features which are required for implementing an automatic 
or self test capability for the TV system in a typical simulator. First, 
repetitive signals which can be displayed on the scope can be digitized and 
stored in a four thousand word buffer memory. The number of samples is 512 
over whatever range of the signal is displayed on the scope. Since the sampling 
is spread over several cycles or repetitions of the signal as previously 
suggested, a ramp signal is generated with the same frequency as the sweep 
frequency. The ramp signal is sampled at the same times as the test signal 
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signal is used for addressing the coincident data 
sample. Consequently, when a signal is sampled, it produces 512 data points 
and 512 addresses. The data storage precision is 10 binary bits. The available 
bandwidth is up to 14 GHz which is way beyond the requirements for the TV 
systems anticipated. 

Secondly, Tektronix has available several time bases with TV sync separator 
triggering. This permits stable internal line or field rate triggering from 
displayed composite video or composite sync waveforms. Conventional waveform 
displays and measurements can be made from closed circuit TV systems with up 
to 1201 line, 60 Hz field rates. Individual lines can be displayed with the 
delayed sweep feature. Since anything displayed can be digitized for processing, 
this enables processing of waveforms such as those generated by test patterns 
such as the window and the grid. Figure 8.4-8(f) and (h). 

__ The stand alone system shown in Figure 8.4-10 is exactly that. The PDP-11 
bmputer shown under the oscilloscope, has a fully developed set of software 

\ 

to permit implementation of most processing operations that , may be required, 
•including Fast Fourier Transform, differentiation, integration, averaging, etc. 
The terminal permits programming to develop specific test sequences or special 
processing facilities. Any operation that can be implemented manually on the 
front of the scope can also be programmed for automatic operation or control 
from the PDP-11. Hard copy equipment can also be attached to produce permanent 
copies of displays from the scope or the terminal: Tektronix obviously has 
available the hardware for interfacing any of the DEC PDP 11 series to the 
DPO as well as support software compatible with this computer. Whether for 
particular applications such as a simulator visual simulation, the choice of 
this ancillary equipment would be the best approach is a question that must 
be decided for each particular case. The alternative is to integrate the DPO 
or its equivalent more fully with the simulator's available facilities and 
make maximum use of available hardware. 

The DPO system as shown in the photo is not totally adequate for TV system 
esting. An additional unit is required to generate the electronic test signals 
that were described in Figure 8.4-8. It should be noted that, depending on 


t 


ad the value of the ramp 
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the unit under test, the signal source must be a test pattern image on which 
camera may be focused,, or it may be an electrical signal that is the output 
of a signal generator such as the Tektronix Test Signal Generators, Models 147A 
($3270) or 143 ($3800). Similar equipment is available from other manufacturers. 


The test circuitry, recommended to instrument one chain of the TV electronics 
is shown schematically in Figure 8.4-11. Additional switching is required for 
the additional chains or video signal paths. Additional switching is also 
required to provide test signal selection capability at the TV test signal 
generator. This will be dependent on the particular unit selected and possibly 
on the numbers of tests used. 


The use of solid state switches (MOS/FET) is recommended as for the DCE, 
Section 8.3. These switches can be installed such that normal simulation 
activities can be carried on as long as no switching command is app.lied to the 
switches. 

*'"'5 A signal/noise ratio meter, such as the Rhode and Schwartz, is shown in the 
_/rcuit. This meter would require switching to sample the signal at the same 
points as, the scope. The meter may prove optional during development of the 
test equipment. 

The computer interface shown in Figure 8.4-11 is not assumed to be the 
PDP-11 that Tektronix equipment is usually interfaced with. The decision as 
to what computer equipment is required must be made at the time the test system 
is developed for a specific simulator, since the nature and extent of simulator 
computer facilities must be considered. . 
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*4.2 Display Equipment 

For the present study, the display equipment is assumed to consist of a 
shadowmask color kinescope viewed through a non pupil forming infinity .disp.l ay 
system. The self test problem with respect to this subsystem is basically that 
of providing an automatic means of perceiving or acquiring performance data 
generally available to only a human observer. In addressing this problem we 
will consider the following topics: 
o Description 

o Characteristic parameters 
o Self test techniques 
o Recommendations 

8. 4. 2.1 Display Equipment Description 

For purposes of this study it is assumed that the color display is pre- 
sented on a shadow mask color kinescope such as shown in Figure 8.4-12. Re- 
cently a new high resolution shadow mask color tube has been introduced by 
'CA which offers a 900 TV line resolution picture at 50 foot lamberts peak 
“White. The tube size is 25 inches diagonally. The RCA type number is C74957. 

As noted in Reference 8.4-4, it is believed that this is the only tube available 
which can achieve the resolution requirements of the Shuttle training simu- 
lators. Such a, tube is shown incorporated into an infinity view optical dis- 
play system, based on Reference 8.4-10, in Figure 8,4-13. 

8.4. 2.2 Characteristic Parameters 

The characteristic parameters associated with the image as presentd on 
the kinesope were identified in Figure 8.4-6 as consisting of the following: 
o Resolution 
o Gamma 

o Low frequency streaking 
o Hign frequency ringing 
o Linearity 
o Registration 

Based on the test signal image displays shown in Figure 8.4-8, it can be con- 
luded that the resolution, linearity and registration measurements require 
accurate positional readings of line and point locations on the CRT face 
either directly or through the optics. On the other hand, the gamma, streaking 
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and ringing measurements also require measurement of illumination level although 
^ith a lesser requirement for positional accuracy. 

8.4.2. 3 Self Test Techniques - 

The characteristic parameters for the display CRT present no peculiar 
difficulties with respect to processing requirements. Many of these parameters 
are processed as part of the TV electronics testing. Consequently the only 
new difficulty in testing the display automatically is the data acquisition 
problem. Unfortunately, this is a major problem. 

The use of TV cameras to view the CRT's has been ruled out categorically 
because of interference problems which can be expected between the camera 
scanning and the CRT sweep patterns. This interference would be apparent as 
Moire 1 patterns which would obviously obscure the desired signal information. 

An alternate conceptual approach is the use of photo transistors as 
point light intensity sensors. Resolution capability of the detector which 
must look through the thick («s.5 inches) layer of glass on the tube fac-e to 
""Ijense the intensity of illumination of the phosphors is a critical consid- 
eration. The sensor must be as close as possible to the tube face and may 
require a small. lens to limit it's field of view. To sense one line of a 
900 TV line image on a 25 inch tube requires the capability of sensing the 
intensity of an image less than .03 inches in diameter. This is in the 
neighborhood of photo transitor dimensions commonly availalbe. A final de- 
termination can only be made for a specific visual system design. 

Accurate positioning of the sensor on the tube face requires servo posi- 
tioning systems on two axes. The use of the hard ware and software from a 
commercially available digital X-Y plotter suggests itself as readily available. 
The advantages of using a drive from a digital X-Y plotter are as follows: 
o No servo system development required 

o Extremely precise positioning of the sensor at any point on CRT 
o Available hardware interfaces to digital computers 
o Software available for driving plotter 
The major development item and expected difficulty in applying this approach is 

8-219 


/WCDOfl/Wetl. DOUGLAS ASTffOIVAUTICS COWPAWV » EAST 



MDC Ell 50 
1 -November 1 974 

the repackaging required for the plotter drive motors and electronics which 
nust be located so as not to interfere with or degrade normal simulation 
operations. The general shortage of space in display optics and the need 
for minimizing weight, on the motion base are additional disadvantages. 

Finally-, either the plotter drives and sensors must be provided for each CRT - 
in the simulator or there must be provisions for them to be moved, possibly 
on a track, from one CRT to another, either by servos or operator intervention. 
In the latter case, the effort required by the operator to relocate the self 
test hardware may exceed the time required to verify CRT operation by direct 
operator observation. Provision of separate drives for each CRT is likely 
to be considered exhorbitantly costly unless an unusually inexpensive source 
for the drives is located. 

Photo transistors are relatively inexpensive and the alternate approach 
of using a grid of sensors that could be slipped into position on the face of 
the CRT has been considered as well as the option of using a single axis servo 
drive. The relative capabilities of these alternatives is summarized in 
Figure 8.4-14. 

8. 4. 2. 4 Recommendations 

„The self- test techniques identified above are highly dependent, with 
respect to their feasibility, on the particular features of the visual si- 
mulation equipment being addressed. Assuming basic feasibility, it is evident 
that substantial development activity is required for any of -the alternatives. 
This development activity must consider packaging limitations of the display 
optics and the number of displays to be checked. .The value of automating 
fully the checkout of the display hardware seems questionable considering 
that there may always remain additional checks or adjustments that must be 
performed manually. 

The provision of self test features for the TV electronics. Section -8.4.1 , 
would make avail abl'e the capability of implementing effective and rapid in- 
teractive checkout of the display electronics by the operator. The automatic 
portion of this testing would consist of cycling desired test patterns, 
‘generated by the TV test signal generator hardware, to each display in turn. 
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The operator could provide a ready signal to procede to each succeeding test 
^nd this could be implemented using interactive devices available in the crew 
station on IOS. Such an interactive approach is recommended. The associated 
software flow is discussed in Section 8.4.4. 
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^8,4,3 Image Generation Equipment Self Test Techniques 

This Section discusses self test techniques for the Image Generation 
Equipment which, as defined above, includes the various spherical and flat 
models, the "drive mechanisms for these models, and the drive servo systems- 
for both camera positioning and optical probe orientation. This equipment 
is discussed after the Image Transmission'and Image Display systems because 
the automatic self test process related here relies on correct performance of 
both of these systems; that is, in the Visual Simulation test sequence, the 
Image Generation Equipment would be tested last. A description of the scene 
generation equipment is presented, together with'a listing of related char- 
acteristic parameters, followed by a discussion of failure modes and self test 
techniques recommended to detect each of these failures. 

Only spherical models are discussed here as they present a variety of 
problems in self test techniques definition which includes those problems 
presented by flat models. A flat model, such as used in terminal area scene 
^generation has no moving parts other than the camera and probe drives. Tech- 
niques used on camera and probe drive checkout for spherical models will also 
be applicable to the same components in the flat models. 

8. 4. 3.1 Equipment Description 

The spherical model systems are implemented with a globe that is precisely 
controlled in both rotation and inclination. The globe is viewed by a closed 
circuit television camera through an optical probe. Angular accuracies of the 
globe mounting assembly are approximately +_ 1/2 minute of arc in both axes 
during static and dynamic conditions. 

The television camera and optical probe assemblies are mounted on top of 
a movable carriage. The optical system of the probe provides simulation for 
the roll, yaw, and pitch attitudes of the spacecraft. Movement of the carriage 
on which the camera and probe are mounted simulates a change in altitude. The 
carriage is positioned to an accuracy of + 0.10 inch under dynamic conditions. 
Figure 8.4-15 shows, the basic components of the Earth Scene Generation subsystem. 
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The globe is suspended by a gimbal yoke. Servo drive systems are used to 
Rotate the globe about both the polar and equatorial axes. The servo system 
is a 15-bit digital system as shown in Figure 8.4-16. A shaft encoder outputs 
angular position in digital format. This output is compared to the digital 
signal from the computer. The error is converted to an analog signal for 
driving the DC motors. A tachometer provides velocity feedback to the servo 
loop for additional stability. 

Pitch, roll and yaw motion of the spacecraft is simulated by servo driven 
prisms within the optical probes. The servo system is a 400 hz, synchro/ 
resolver system as shown in Figure 8.4-17. Sine and cosine signals are sent 
from the digital computer; these signals are converted to 400 hz analog signals 
which have output magnitudes proportional to the digital sine/cosine values. 

These outputs drive a control transformer. The control transformer outputs an 
error signal whenever the angle input specified by the sine/ cosine does not 
equal the shaft angle of the prisms. This error signal is amplified and demod- 
ulated. The resultant is a signal then drives a torque motor' which, turns the 
.shaft until the command input angle is reached. A tachometer provides rate 
feedback for increased stability of the servo loop. 

8. 4. 3. 2 Failure Modes •' * 

The failure modes, shown in Table 8.4-1, for the spherical model with 
the digital servo system, are described as follows: 

No Shaft Movement - No shaft movement is indicated by the shaft encoder output 
remaining constant with changing input commands. 'This indicates that no current 
is reaching the torque motor. This failure is likely caused by a fault in the 
digital comparison circuit or in a power supply failure. Other possibilities 
include failures in the D/A converter, amplifier, or torque motor. 

Shaft Position At Either Extreme - The shaft remains at the limit stops .regard- 
less of command input. This indicates that a constant drive is applied to the 
torque motor. This failure is likely caused by a shorted output in the amplifier 
driving the torque motor. Other possible causes include shorted first stage 
amplifier, shorted D/A converter output, or digital comparator failure. 
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Shaft Position in Error - The shaft moves to a position with a commanded input, 
fbut the position is not within the specified tolerance range. This failure is 
likely caused by a mechanical misalignment of the globe or misalignment of the 
shaft encoder with respect to the 'globe shaft. Other possible causes include 
failures in the shaft encoder, digital comparator, or D/A converter. . 

Instability In The System - This failure is likely caused by a malfunction in 
the tachometer or by degradation or failure of components in the amplifiers. 

The entire probe unit is assumed to be an LRU. for this study. Association 
of faults with particular components of the probe is not necessary for imple- 
menting the desired tests. 

8. 4. 3. 3 Characteristic Parameters 

The measureable parameters for the spherical model driven by the digital 
servo system, shown in Figures 8.4-15 and 8.4-16 are as follows: 

Input - The input is a 1 5-bit ‘digital word specifying commanded shaft 
angle. 

Shaft Encoder - The output of the shaft encoder is a 15-bit digital word 
specifying the shaft angle. 

Digital Comparator Output - The output of the digital comparator is a 

15-bit v/ord that is the difference between the command input and 
the shaft encoder output. 

Digital -to-Analog Converter Output - The output of the digital-to-analog 
converter is an analog representation of the digital comparison 
output. 

Tachometer Output - The tachometer output is a DC signal proportional to 
rate. 

The measureable parameters for the probe unit with the synchro/resolver servo 
system, shown in Figure 8.4-17 are as follows: 

Control Transformer Output - The output of the control transformer is a 

400 hz analog signal that indicates whether the commanded position 
has been reached. The output becomes zero when the shaft angle 
corresponds to the command angle. 
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Tachometer Output - The tachometer output is a DC signal proportional 
to rate. j 

Demodulator Output - The output of the demodulator is a DC representation 
of the control transformer output; 

The characteristic parameters appropriate for evaluation of the performance 
of both the model and the probe unit servo systems are the following: 

9 Static calibration 
e Rise time 

e Peak overshoot 

c Settling time 
e Steady state error 

These characteristic parameters can essentially be obtained by acquiring 
the above measureable parameters as shown in Figures 8.4-16 and 8.4-17. 

8.4. 3.4 Image Generation Equipment Hardware Requirements 

In considering hardware self test techniques for this .equipment it is 
Necessary to recognize that certain calibration procedures and dynamic tests for 
visual scenes involve an experimental determination of the gains or correlation 
matrices in the computer software that generates the commands for model or camera 
motion. These software adjustments may be used to bring into synchronism or 
proper juxtaposition the scenes generated by several different models or devices. 
For example, the images of a rendszevous target, the global earth scene, the star 
ball and the horizon mask are frequently superimposed. These procedures represent 
performance verification activities and, because of the judgment required for 
assessment of complex images, are best performed manually. There remain specific 
mechanical tests that can be automated, and that constitute useful checks in a 
daily readiness procedure. 

The failure modes surmiarized in Table 8.4-1 represent faults that would appear 
as either static calibration type errors or dynamic response degradation effects. 
The characteristic parameters noted in the previous paragraph may be applied to 
check for both. 
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. The static calibration checks required for model drive calibration are best 
finplemented on the model drive system itself and are highly sensitive to the 
particular hardware configuration. Typically, a potentially useful approach would 
imvolve the imbedding of a light source in the moving element such as the globe. 
Alignment of the light source with a fixed reference point on the gimbal structure 
can then be detected by use of a light sensor such as a photodiode previously 
discussed. Alternately a minute reflecting surface might be provided on the moving 
component to avoid wiring runs to a moving device. Masking of both the Itght source 
and the sensor may be required to provide the necessary precision. The resulting 
test would simply be a direct check of a mechanical null such as might be 
implemented manually. 

The dynamic response of the various servo systems can be checked to detect 
the faults that reveal themselves in dynamic performance degradation. The dynamic 
tests can be implemented using the standardized step response technique described 
in Section 7.1. The feedback signals from the closed loop servo systems are the 
most accessible sources of position response data. 

> 

A generalized software flow for the test software to assess scene generation 
equipment for proper static and dynamic operation are discussed in Section 8.4.4. 

8.4.4- Visual System Self Test Software Requirements and Data Base Impact 

The test software required for implementing visual subsystem self test 
techniques has been divided into three major software modules. These three modules 
are VISTST, the top level visual subsystem test module, VIDTST, the video subsystems 
self test module, and GENTST, the image generation equipment self test software 
module. Each of these makes use of more fundamental software modules for 
implementing the required tests and will be discussed further. ” •' 

VISTST, the overall visual subsystem self test module, shown in Figure 8.4-18, 
exercises the other two modules, VIDTST and GENTST as required. VISTST is 
primarily intended for the visual subsystem test executive. However, it seemed 
reasonable or efficient to make VIDTST a general purpose video or TV hardware test 
routine. As such, VIDTST' is useful for testing either a single string of TV system 
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FIGURE 8.4-18 VISUAL SUBSYSTEMS TEST SOFTWARE, VISTST 
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,4-18 VISUAL SUBSYSTEMS TEST SOFTWARE, VISTST (CONTINUED) 
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components end to end, or for testing a single LRU within that string, or for testing 
subset of components w-ithin the string. Consequently, when dealing with an 
IGB color TV system, the executive subprogram, VISTST, provides the logic for testing 
the red, the green, and the blue hardware strings individually and then implements 
the test for image registration. The registration test is only relevant if the 
optical interface of the TV camera is in the test circuit. The signals coming out 
of the camera are already divided into the component colors and the registration 
test is meaningless beyond that point. Following the registration tests, VISTST 
implements the incipient fault detection analyses using the fault isolation test 
procedures for either presently unacceptable end to end performance levels or for 
degraded performance levels which indicate incipient faults. Finally, VISTST calls 
GENTST which executes both static calibration and dynamic test for the servo systems 
in the scene generation equipment. 

VIDTST, the basic video equipment test software, shown in Figure 8.4-19, 
executes the basic TV tests described in Section 8.4.1. VIDTST establishes values 
for the following parameters: 

o Set up voltage 
o Gamma 

o Differential Gain 
o Frequency Response (Amplitude) 
o Peak/Peak voltages 
o 'Signal/Noise ratio 

In addition, VIDTST checks streaking and ringing faults against tolerable levels 
and also checks to determine if linearity deviations are within acceptable limits. 
This complete set of tests can be applied to a complete string of TV components 
including the camera tube optical interface if a test- pattern is used for a test 
signal input. This set' of tests may also be applied at the LRU or least replaceable 
component level for fault isolation purposes. 

GENTST, the test software routine for testing static alignment or calibration 
as well as dynamic response of the servo systems in the model generation equipment 
is shown in Figure 8.4-20. GENTST uses previously defined routines to implement 
the transient response tests for the servo systems and then uses the marginal 

* 
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FIGURE 8.4-19 VIDEO EQUIPMENT TEST SOFTWARE, VIDTST 
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FIGURE 8.4-19 VIDEO EQUIPMENT TEST SOFTWARE, VIDTST (continued) 
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FIGURE 8.4-19 VIDEO EQUIPMENT TEST SOFTWARE, 
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performance, or gray area, approach to check for incipient faults. Sophisticated 
feult isolation techniques have not been shown because the choice of any particular 

y 

technique requires development work of a higher magnitude than the tests generally 
outlined in the present software, flows. The frequency response or fault dictionary 
type techniques are applicable to the servo systems of this type and may be applied 
if necessary. 

The data base requirements of the tests described above are very nominal for 
several reasons. First, the signal generator used for the video subsystem tests 
is a hardware signal generator. Consequently, signal generation requires only 
switching commands. Test voltage levels for each' test can be adjusted by built-in 
voltage dividers in each input line such that the signal generator always supplies 
ah output voltage at a constant signal level no matter where the signal is inserted. 
In addition, the hardware components in each string of TV hardware are characterized 
by similar performance levels. Consequently, the tolerances for a given parameter 
are identical for each component color path, i.e., red or green or blue. 
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8.5 MOTION SYSTEM 

This section defines hardware and software techniques for checking the 
operational status of a simulator motion bas.e. It describes the system con- 
figuration and defines the parameters characterizing its output. It notes 
anticipated failure modes and associated symptoms. It discusses the proces- 
sing requirements and transmission of sensed parameters to a computer for 
verifying proper operational performance as well as for isolating faults to 
a defective unit. 

8.5.1 Description 

Investigation of candidate motion bases for the Shuttle_.Mission Simulator 
(Reference 5.2-1} has indicated, that a moving, platform powered by hydraulically, 
driven actuators has .advantages over other possible; kinematic schemes. These 
advantages in mass movement^ capability, range -of displacements, velocities and 
‘and accelerations have dictated that such a system will be used. State-of-the-art 
hardware- also suggests' using a six degree of freedom synergistic system. 


The motion system with six degrees of freedom (DOF) is made up of two 
basic subsystems with peripheral hardware components. The first subsystenfTs 
a payload supporting a moving platform driven by a synergistic system of six 
hydraulically powered actuators. The second subsystem is the hydraulic system 
controlling the motion base movement through an electrohydraulic servo control 
loop. Interfacing hardware are a Tilt Frame mounted on top of the motion base 
platform, a redundant set of emergency cushioning legs, a hydraulically driven 
access walkway, a group of Control Panels and a number of Hardware Interlocks. 

i 

8. 5. 1.1 Moving Platform 

Figure 8.5-1 illustrates the motion base geometry. The moving base and the 
six hydraulic actuators form a space frame tha't is stable and determinate for 
any combination of lengths of the actuators. A set of six redundant legs may 
be installed as .an emergency cushioning feature in the unlikely event of break- 
age of a servoed leg actuator. These additional legs are self contained hydrau- 
lic springs exerting a lifting force on the platform as a result of the pressure 
in independent accumulators mounted on each leg. A movable walkway is configured 

t , 

4 

t 
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TOP VIEW 




FIGURE 8.5-1 motion BASE SEOMETRY 
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for ingress and egress to the motion base platform. This access unit is 
positioned by independent hydraulic actuators. 

A Tilt Frame will be mounted on the basic motion base platform to provide 
an increased pitch envelope capability and a higher pitch velocity (see 8.5.1 .2). 
Lateral tilt frame motion is constrained by mechanical linkage. 

8. 5. 1.2 Hydraulic System 

The hydraulic system is schematically illustrated in Figure 8.5-2» which 
also depicts the required system parameters (sensors) by bubble notation. The 
power for the motion base consists of electrically driven hydraulic pumps 
supplying high pressure oil to a system manifold where the flow capability to 
the hydraulic actuators through the electro-hydraulic servo valves is augmented 
by an accumulator system. System filtering and pressure relief hardware is 
• provided. A hydraulic reservoir will supply fluid to the pumps at a satis- 
factory net positive suction head(NPSH). The oil temperature during periods of 
high activity of the motion base is controlled by a return line heat exchanger. 
Table 8.5-1- defines the system parameters and their characteristics, 

A Tilt Frame (see 8. 5. 1.1) will be cascaded on the Motion Platform to pro- 
vide +75° positive pitch angle to the crew station and visual system indepen- 
dent of the pitch capability of the motion system. Tv/o servoed hydraulic 
actuators, acting in parallel, are. powered off the motion base hydraulic supply 

distribution manifold to provide a short duration maximum pitch velocity of 60 
degrees per second when augmented with the motion system pitch velocity. 

8.5.1 .3 Motion Base Hardware Interlocks 

The system is protected by the following hardware interlocks: 
o Proper sequencing for power up and power down with abnormal conditions 
inhibiting the application of power to the motion platform. 
g Travel limits within the travel envelope are sensed and a smooth decel- 
eration of less than 2.5g is assured when these limits are approached 
at maximum velocity. 
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TABLE 8, 5-1 PARAMETER CHARACTERISTICS 


PARAMETER 

ESTIMATED 

SENSOR 

RANGE 

NOMINAL SYSTEM OPERATING RANGE AND 
OPERATIONAL CONTROLLING FACTORS 

RESULTS OF MALFUNCTION 

n 

0-3000 psig 

2000 j\200 psig - Controlled by specific pump 
outputs, pressure regulating valves and 
relief valves. On hydraulic system activation 
(pump ON) the system pressure should rise and 
remain steady within approximately a +25 psig 
long range variation caused by temperature 
effect on the pump hardware and oil viscosity. 

If pressure indicates low a programmed maximum 
demand on the hydraulic system may not be met 
and a M.B. command may not be completed or 
there may be a command resoonse lag. 

If pressure indicates high the response to all 
commands may be accelerated, destroying the 
preplanned verifying reDeatability of the pro- 
gram and subjecting the M.B. and hydraulic 
system to excessive stress. 

5n 

0-50 psig 

5-20 psig - Controlled by the_ hydraulic 
pressure head between the hydraulic reservoir 
and the pump inlet. 

If inlet pressure indicates low the hydraulic 
pump may cavitate resulting in possible pump 
damage or reduction of the hydraulic system 
pressure with resultant system response lag. 
Also a low indication could result in the in- 
troduction of gas into the system resulting in 
a spongy response lagging system. 

HYDRAULIC 
RESERVOIR 
OIL LEVEL 

JD 

0-1 002 

- Controlled by specified fill level. 
If level indicates low the system has not been 
properly serviced or there is a significant 
leak in the system. 

If reservoir level indicates low the pumo in- 
let line could have insufficient fluid head 
and cavitate when there is a high M.B. flow 
demand situation resulting in pump damage and 
or intVoduction of gas into the system. 

1 rmn^nVftTlT3 

0-3000 psig 

1500 +150 psig - Prior to hydraulic system act- 
ivation - Controlled by accumulator servicing. 
2000 +20 psig - After hydraulic system activa- 
ted - Controlled by accumulator servicing and 
hydraulic system pressure. 

If precharge indicates low there could be an 
insufficient pressurized volume of oil -to 
complete a high demand command . 


0-300 psig 

200 +20 psig - Prior to hydraulic system 
activation - Controlled by accumulator 
servicing. 

If precharge indicates low the motion system 
might function in a somewhat erratic (jerky) 
manner, due to the non damped hydraulic -flow. 



40-1 60°F - Controlled by diurnal temoerature 
and frictional (fluid and mechanical) energy < 
transferred as heat into the Tluid. Excessive 
temperature indicates excessive activity by 
simulator, a malfunctioning return line heat 
exchanger, an internal friction source or a 
combination of the three. 

1 60°F is the high side of the operational 
specification requirement for MIL-H-5606 
hydraulic oil in an open loop system. Also 
its minimum flash point is 200° F. 

filter 

differen- 

tial 

PRESSURE 

0-100 psid 

0-30 psid - Controlled by contamination 
of the filter. 

If differential pressure is high oil flow in 
that specific loop could be reduced possibly 
causing a command response lag. 

actuator 

POSITION' 

FEED8ACK 

0-1002 

End to End (O-xx)inches = Mechanically 
controlled by electro hydraulic servo 
calibration. Dynamically controlled by 
the system response. 

If response to comnand is not within a pre- 
determined band the Motion Base is not 
verified as ready for operation. 
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e Two sets of limit switches on each actuator are provided to: 

1) Shut down the motion system in the case of sensed actuator position 
beyond the servo electronic limit or against a mechanical limit. 

-2) Attenuate motion system velocity in the event of a -runav/ay servo, 
e Emergency deactivation switches are provided at the control station, 
at the hydraulic system and at the payload that will immediately remove 
all electric power from the system, returning the platform to the 
"settled position" at a smooth controlled rate, 
e Key switches will ensure exclusive local control of electrical and 
hydraulic power at the payload and at the hydraulic supply during power 
down maintenance. Additionally, "motion-on" will be interlocked with 
the seat harness and payload doors for personnel protection. 


8. 5. 1.4 Hydraulic Control Panels 

There will be a Hydraulic Control Panel, a Motion System Maintenance 
Control Panel, a Cylinder Position Control Panel, and a Test Point- Panel. The 
Hydraulic Control Panel includes provisions for semi-automatic trouble shooting 
of the Hydraulic Power Control Systems. This panel includes the following sys- 
tern displays. Those with an asterisk indicate sensors measuring analog levels. 

Hydraulic Power Master Control System Status (e.g., Sim. Auto/Sim. Manual) 

Pumps Start Status 

Motion Base Actuator Bypass Valve Status 
*Hydraulic Fluid Level (Reservoir) and Temperatures 
*Hydraulic System Accumulator Precharges and Fluid Levels 
^Hydraulic Filter Differential Pressures 
*Hydraulic System Pressure and Temperatures 
*Motion Base Commands 

*Actuator Position Feedback (Servo Position) and Associated Servo Errors 
*Access Platform Accumulator Precharge and Fluid Levels. 


The Maintenance and Cylinder Position Control Panels are equipped with 
controls and indicators for manual operation of the system, thereby isolating 
the' computer inputs. The intention of this feature is to allow each servo to 
be checked operationally without removing the servos from the system or to 
allow operation of the system entirely through manual or analog means of control 
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(i.e., off-line). The' Test Point Panel provides easily accessible, test points 
■of critical signals associated with each servo actuator. \ 

8.5.2 Failure Mod.e Analysis 

Table 8.5-2 lists the failure modes and related symptoms. Given a set of , 
symptoms identified, by a software program, the associated malfunction mode may. 
isolate the problem to a specific replaceable unit. Unlike the black and white, 
go/no-go nature of electronic parameters, fluid system (hydraulic) parameters 
have a normal operating band trace (signature) indicating a range within which 
operational requirements for that system are met. If the parameter value is 
outside the signature trace but 'within the broader operational requirements 
band, an incipient hardware failure is suggested, and the anomaly should be 
resolved prior to continuing the checkout or simulation. Table 8.5-3 denotes 
checkout test techniques which will evaluate specific malfunction modes. The 
checkout test techniques are discussed in paragraph 8.5.3. 

8.5.3 Checkout Techniques Evaluated 

Table 8.5-4 lists characteristics of Candidate Checkout Testing. Techniques. 
Table 8.5-3 notes Checkout Test Techniques which will evaluate specific mal- 
function modes. 

8. 5. 3.1 Static Checkout (Power ON and OFF) 

A certain number of measurements and obVersations can be performed on a 

motion base while the system .is in a static mode. Proper selection of these 

observations can yield a list of items that po’int to the operational status of 

the system without the need for actual movement of the base. 

» * • 

Static Power OFF Checkout 

Prior to power ON activation of the Motion Base and Hydraulic Systems the 
following parameters status should be verified. 

© Verify position of the motion base (actuator position feedbacks). 

©Verify proper fluid level of hydraulic reservoir, 
c Verify proper supply line accumulator precharge, 
c Verify proper return line accumulator precharge, 
e Verify proper hydraulic system operating pressure, 
e Verify no hydraulic leaks. 

8-246 

MCDOWA/ELL DOUGLAS ASTRONAUTICS COMPANV - EAST 



TABLE 8.5-2 FAILURE MODES 


MDC El 150 
1 November 1974 



SYMPTOMS 1 

MALFUNCTION MODE 

EXTERNAL 

INTERNAL 


UNABLE TO ACTIVATE PART OR ALL 
OF THE COMPONENTS OF THE M.B. 

NO CONTINUITY. 

ELECT. SHORT CIRCUIT 

AS ABOVE 

LOW' RESISTANCE. 

COMPUTER AND OR DATA 
CONVERSION EQUIPMENT 
(DCE) 

ERRATIC SYSTEM PERFORMANCE 

INVALID COMMAND LOOPS AND/OR 
RESPONSE. 

HYDRAULIC OIL 
RESERVOIR LEVEL LOW 

LOW HYDRAULIC PRESSURE , 
PUMP NOISY 

LOW RESERVOIR OIL LEVEL CAUSING 
HYDRAULIC PUMP TO CAVITATE. 

HYDRAULIC PUMP PRES- 
SURE OUTPUT LOW 

LOW HYDRAULIC PRESSURE 

PUMP INTERNAL LEAKAGE , PUMP 
DAMAGE, OR LOW RPM 

ACTUATOR 

MOTION 

ERRATIC 

MOTION BASE MOVEMENT JERKY OR 
LOCKS UP AND WILL NOT COMPLETE 
COMMANDED MOVEMENT. 

ACTUATOR PISTON ROD BENT OR 
BEARING SEIZED. 

ELECTRO HYDRAULIC 
SERVO VALVE 

RESPONSE (OUTPUT) LAGS COMMAND 
(INPUT) 

IN AMPLITUDE 
IN VELOCITY 
IN FREQUENCY 

MOVEMENT RESTRICTION (M.B. 
TABLE OR ACTUATORS). FLOW 
RESTRICTION OR INSUFFICIENT 
SUPPLY LIME ACCUMULATOR 
PRE-PRESS. 

MALFUNCTIONING SERVO VALVE 

, G^N HYDRAULIC 

’ s"m 

MUSHY SYSTEM 

RESPONSE LAG 

FILTER BLOCKED 

HIGH FILTER DIFFERENTIAL 
PRESSURE 

CONTAMINATED FILTER (DIRTY 
HYDRAULIC OIL) 

FILTER OPEN 

LOW FILTER DIFFERENTIAL 
PRESSURE 

FILTER UNIT FLOW THROUGH (NOT 
FILTERING) 

ACTUATOR POSITION 
FEEDBACK 

DELAY IN RESPONSE TO COMMAND 
FOR ACTUATOR POSITION. 

EXCESSIVE ERROR (LAG)ACTUATOR 
POSITION TO COMMAND. 

SUPPLY LINE ACCUM 
LOW PRE-CHARGE 

FAILURE OF ACTUATORS TO REACH 
HIGH DEMAND COMMANDED 
AMPLITUDE. 

INSUFFICIENT SUPPLY LINE FLUID 

RETURN LINE ACCUM 
LOW PRE -CHARGE 

ERRATIC (NOT SMOOTH) M.B. 
MOVEMENT 

RETURN LINE OIL SURGES NOT 
DAMPED 
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TABLE 3.5-3 

CHECKOUT TEST TECHNIQUE WHICH WILL EVALUATE SPECIFIC MALFUNCTION MODE 



. _MQDE. MALFUNCTION 


ELECTRICAL OPEN CIRCUIT 


ELECTRICAL SHORT CIRCUIT 


COMPUTER AND/OR DATA CONVERSION EQUIPMENT(DCE) 


HYDRAULIC OIL RESERVOIR LEVEL LOW 


HYDRAULIC PUMP PRESSURE OUPUT LOW 


ACTUATOR MOTION ERRATIC 


ELECTRO HYDRAULIC SERVO VALVE 


GAS IN HYDRAULIC SYSTEM 


FILTER BLOCKED 


FILTER OPEN 


ACTUATOR POSITION FEEDBACK 


SUPPLY LINE ACCUMULATOR LOW PRE-CHARGE 


RETURN LINE ACCUMULATOR LOW PRE-CHARGE 




CHECKOUT TESTS 
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TABLE 8.5-4 CHARACTERISTICS OF CANDIDATE CHECKOUT TESTING TECHNIQUES 


CANDIDATE 

TECHNIQUE 

1 

ADVANTAGES 

DISADVANTAGES 

HARDWARE 

REQUIREMENTS 

SOFTWARE 

REQUIREMENTS 

STATIC 

CHECKOUT 

MINIMAL 

1. PRE HYDRAULIC ACTIVATION 
CHECKOUT. 

NO M.B. DYNAMICS, 

ALL HYDRAULIC 
ELECTRIAL AND 
MECHANICAL 
SYSTEMS PARA- 
METERS (SEN- 
SORS) NOTED 
ON FIGURE 2 
HYDRAULIC 
SCHEMATIC. 

ALL HARDWARE 
SENSORS PIPED 
INTO COMPUTER. 


POWER ON 

POWER OFF 

MINIMAL 

1. POST HYDRAULIC ACTIVATION 
CHECKOUT. 

MAXIMUM 

MISSION 

PROFILE 

(STEP 

INPUT) 

MODERATE 

1. SINGLE DAILY CHECKOUT. 

2. MODERATE STRESS ON M.B. AND 
PAYLOAD* PRIOR TO DAILY 
OPERATIONS. 

3. MODERATE CAPABILITY FOR DE- 
TECTION OF INCIPIENT FAILURES 
OF HARDWARE AMO SYSTEMS. 

4. GOOD PROBABILITY OF HARDWARE 
OR SYSTEMS FAILURE PRIOR TO 
RATHER THAN DURING DAILY 
OPERATIONS. 

1. MODERATE STRESS ON M.B. AND 
PAYLOAD*. 

2. LARGER CUMULATIVE STRESS (EX- 
CESSIVE?) CAUSED BY CHECKOUT 
THAN BY TRAINING OPERATIONS 
IF RUN DAILY. 

AS ABOVE 

’ 

AS ABOVE 

! - 
1 

i 

1 

TRAINING 

MISSION 

PROFILE 

+102. 

(STEP 

INPUT) 

MODERATE 

1. MINIMUM STRESS ON M.B. AND 
• PAYLOAD* PRIOR TO 

DAILY OPERATIONS. 

2. FAIR PROBABILITY OF HARDWARE 
OR SYSTEMS FAILURE PRIOR TO 
DAILY OPERATIONS. 

1. ONLY NOMINAL CAPABILITY OF DE- 
TECTING INCIPIENT FAILURES OF 
HARDWARE AND SYSTEMS. 

2. SEVERAL DIFFERENT DAILY 
CHECKOUTS. 

* 

AS ABOVE 

AS ABOVE 

■ 

MODERATE 

1. SINGLE DAILY CHECKOUT, 

2. BEST CAPABILITY FOR DETECTION 
OF INCIPIENT FAILURES OF 
HARDWARE AND SYSTEMS. 

3. BEST PROBABILITY OF HARDWARE 
OR SYSTEMS FAILURE PRIOR TO 
RATHER THAN DURING DAILY 
OPERATIONS. 

1. EXCESSIVE STRESS ON M.B. AND 
PAYLOAD*. 

2. PROBABLE CAUSE OF FAILURES DUE 
TO EXCESSIVE STRESSES IMPOSED 
DAILY. 

AS ABOVE 

* 

AS ABOVE 

, 

FREQUENCY 

RESPONSE 

MODERATE 

1. BEST MISSION CHECKOUT 
SIMULATION. 

2. NOMINAL STRESS ON M.B. SYSTEMS 
PRIOR TO DAILY OPERATIONS. 

3. GOOD CAPABILITY FOR DETECTION 
OF INCIPIENT FAILURE OF 
HARDWARE AND SYSTEMS. 

1. EXCESSIVE STRESS IMPOSED ON 
M.B. AND PAYLOAD* FOR MOST 
DAILY OPERATIONS. 

2. POST DAILY CHECKOUT EVALUATION 
TIME REQUIRED MAXIMUM. 

AS ABOVE 

AS ABOVE 
1 

, s 


*Pavload consists of Cockpit, Personnel, Tilt Frames, and Visual Display. 
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Static Power ON Checkout 

In each of the following techniques the motion base checkout should be 
preceded by verifying the following parameters with the hydraulic system acti- 
vated (hydraulic oil flowing) but with the motion base actuators bypassed or 
locked in 'place (motion base settled). 

o Verify proper position of motion base (actuator position feedbacks) 
e Verify proper fluid level of hydraulic reservoir 
e Verify proper net positive suction head" at pump inlet, 
o Verify proper hydraulic system operating pressure. 

© Verify proper differential pressure for all filters. 

8. 5. 3. 2 Step Input Checkout 

Step input stimuli can be used to verify the operational and dynamic re- 
sponse capabilities of the motion base. This technique permits activation of 
the system in various and individual planes of motion, thereby permitting isol- 
ation of probable faults to specific components. 

Maximum Mission Profile (Step Input) 

This is a technique that exercises the motion base by Step Input commands 
actuating all six synergistic actuators. The steps will be equivalent to those 
resulting in the maximum dynamic stress encountered in any of the training 
missions. The program must verify the actuator position feedback as well as 
discrete values for all hydraulic, mechanical and electrical parameters. 

Comments: This technique would evaluate daily' the operational status of the 
motion base to respond to the maximum programmed step input simulation activities 
without subjecting the motion base to excessive (out of maximum operational 
mode) stress. However, it would in most instances impose more stress than the 
daily training mission requires. In so doing it may force marginal components 
to fail during the actual training mission. It is only moderately likely that 
this technique wo u 1 d point to areas of incipient failure of hardware or systems 
as a more demanding frequency response analysis might do. 
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Training Mi ss ion Profile Maximum Stress +10% 

This is a technique that exercises the motion base by step input commands 
equivalent to. those being imposed by the training mission being implemented 
that day plus a pre-established figure (e.g., 10%). The program must verify 
the actuator position feedback as well as discrete values for all hydraulic, 
mechanical and electrical parameters. 

Comments : This technique would evaluate daily the operational status of the 

motion base to respond to that particular day's training mission's commands. 

It would exercise (stress) the motion base only 10% above the programmed 
daily requirements. If a hardware component failure was imminent it should 
fail during the checkout prior to and not during the training mission. Of the 
techniques submitted, this one imposes the least cumulative stress on the motion 
base system but also retains only a small capability to detect incipient hard- 
ware failures and degrading systems; also it entails the use of several differ- 
ent checkout profiles, of which the profile matching the most severe pertinent 
training activity would be utilized. 

Motion Base Limit Profile (Step Input) 

This technique is basically the same as the Maximum Mission Profile except 
that the step input commands include the maximum design capability of the motion 
base under maximum dynamic load, maximum motion base velocity and maximum 
hydraulic fluid flow. The program must verify that discrete values for all 
hydraulic, mechanical and electrical parameters are attained. 

Comments : This technique would evaluate daily the. operational status of the 

motion base to respond to commands imposing the highest operational stress 
levels within the system's design capability of the motion base and hydraulics, 
(e.g., rotational acceleration of approximately 50°/sec 2 and directional accel- 
eration of approximately (0.6 to 0.8g). This level of checkout would undoubt- 
edly be excellent in detecting areas of incipient hardware and systems failure, 
but the daily implementation of associated high stress might very well cause ’ 
unnecessary failures. 
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|) 8. 5. 3. 3 Frequency Response 

This technique has been implemented on motion bases in operation^ at NASA- 
AMES (Reference 2) and at Langley Research Center (Reference 5). The basic pro- 
gram, called SAFE (six axis frequency evaluation), operated an electro-mechanical 
motion base at AMES. Modifications were made at Langley to enable the program- 
to operate a hydraulic motion base and perform the required inverse tranformation. 


A digital computer program SAFE drives each axis of the simulator near its 
acceleration, velocity and position limits, and records the simulator motions 
for comparison with nominal responses. It should also measure the frequency 
response and noise levels of each axis to provide a sensitive check of the 
entire motion system. If the frequency response and power capabilities of 
simulator drives are poor, or deteriorating, the motion simulation will be 
correspondingly poor. 



To determine the current characteristics of the motion base the following 
measurements are made on a specified time-interval basis: 

© Each axis of the simulator is driven near its acceleration, velocity, 
and position limits by acceleration commands, and the responses- are 
compared with nominal values. 

© Up to six axes of the simulator are simultaneously driven by a sum of 
sinusoids, and the position follow-up signals are used to calculate 
the frequency response and noise levels of each axis. ; 


The results of these two measurements provide a sensitive check of the 
entire motion system and readily verify whether or not: 

4 

© there is continuity of signal from the digital computer to the motion 
drives. 

© the position follow-up pots are Working. 

© there is continuity of signal from the position follow-up pots tothe 
digital computer. 

e the digital motion drive circuits, including gains, washouts, compensation 
networks and cross-feeds, are working properly. 

© the simulator drives are responding normally. 
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o there is undesired cross-talk between axes. 

o the system noise level is acceptably low. 

o there are unexpected non-linearities or resonances in motion response. 

Reference 2 provides a complete description of the analysis technique, 

which involves: 

o Step or ramp acceleration commands scaled and timed to cause the 
simulator to perform near its acceleration, velocity, and position 
limits for each axis. 

o Recording of motion base feedback signals on stripcharts for comparison 
with standard dr expected results. 

o The motion base frequency response is analyzed using a Fourier transform 
(in this case a fast Fourier transform to conserve computer resources) 
to determine the presence of noise, cross-coupling, or degradation in 
motion base response. 

8, 5. 3. 4 Software Utilization 

4 For convenience, a software package will be utilized to operate the motion 
-base for the daily readiness tests. This software is intended to provide an 
orderly and logical test sequence that proceeds through the necessary verifica- 
tion steps to isolate discovered faults, with a minimum of operator intervention. 
Because an individual test may be desired at non-specific times, the test soft- 
ware will be modularized for maximum operational flexibility. 

r 1 

The different modules are illustrated in Figures 8.5-3, 3.5-4, and 8.5-5- 
The modules are sequenced by a master (executive) program that orders the 
modules into .a logical verification procedure. See Figure 8.5-6. 

The master program also controls the recording of verification test data 
for future comparison or analysis. Data of this nature may be valuable in 
establishing trends of events that lead to component failure, making it possible 
that through analysis of such trends corrective action may be possible before 
an actual failure. Data gathered through operation of the frequency analysis 
technique module may provide this type of clue. 
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MASTER 

SEQUENCING 

PROGRAM 


SIMULATION 

SOFTWARE 


TEST THE 
ELEMENTS 
OF 

DATA SET 1 


BYPASS 

VALVE 


TEST THE 
ELEMENTS 
OF 

DATA SET 2 


CLOSED 
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\ 1 
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[ 
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* 
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i 
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, i 

NO j 


SETTLED^ 

TEST THE 
ELEMENTS 
OF 

DATA SET 2 


TEST THE ' 
ELEMENTS 
OF 

DATA SET 2 


n. B/\N0: MOTION BASE OPERATING 
LIMITS J> — 1 


MESSAGE: 
MOTION BASE 
AT LIMIT X 


NOMINAL 

NOMINAL- 

NOMINAL- 

I NOMINAL . 

• r 

fir . • \ 


A. u 

V 

1 . | 

( STOP 


OPEN BYPASS 
..VALVE 


CLOSE BYPASS 
■VALVE 7 


MOTION BASE 
STATIC CHECK 
COMPLETE 


RETURN 


MESSAGE; 
MOTION BASE 
AT NEUTRAL 
AND READY 


RETURN 


TEST THE 
ELEMENTS 
OF 

DATA SET 2 


RETURN 


MESSAGE: 
TURN M. B. 
POWER ON ' 


CALLING 

MODE 


MESSAGE: 
ERROR X 


RETURN 


DATA SET I : 

OIL LEVEL 
NPSH 

S YSTEM P RESSURE 
ACTUATOR POSITION 
F EEDBACK ' ‘ 

SUPPLY LINE ACCUM- 
U LATOR P RECHARGE 
RETURN LINE ACC-- 
UMULATOR PRECHARGE 


DATA SET 2: 

O IL' LEVE L 
NPSR 

S YSTEM P RESSURE 
ACTUATOR POSITION* 
FEEDBACK 

FIlTer AP 1 s 
M7X COMMANDS {8) 


MESSAGE: ERROR X 
M. B. OPERATING- 
STAND BY TO TERM- 
INATE OPERATION 


STORE ERROR 
DATA FOR SIM. 
PROGRAM 


FIGURE 8.5-3 STATIC CHECKOUT MODULE 


""T 


RETURN 


NOTE: THE ELEMENTS OF THE 
DATA SETS ARE TESTED 
AGAINST BASELINE 
VALUES FOR EACH OF THE 
ABOVE MOTION BASE 
PHYSICAL CONDITIONS. 


THE BASELINE VALUES 
MUST BE DETERMINED FOR 
EACH CONDITION AFTER 
ORIGINAL MOTION BASE 
INSTALLATION 
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OPERATOR 

CALL 


MASTER 

SEQUENCING 

PROGRAM 


DEFINED 


UNDEFINED 


SELECT MOTION COMMANDS 
BAS FD Oil TEST TYPF 
STORE MOTIOII COMMANDS 
IN MOTION COMMAND TABLE 


MESSAGE: 
MOTION BASE 
POWER 
IS OFF 


CALLING 

MODE 







MESSAGE: 

READY MOTION 
BASE FOR 
TEST ACTIVITY 



( 7 ) TRAINING MISSION PROFILE TEST ■ 
INPUT COMMANDS DETERMINED BY 
SEVERITY OF MOTION COMMANDS 
EXPECTED DURING SPECIFIC 
TRAINING MISSION ■ 

* TRAINING TYPE REQUESTED IS THE . 
CODE FOR THE TRAINING MISSION WHICH 
GENERATES THE MOST EXTREME MOTION 
COMMANDS 


SELECT S 

STORE 

MOTION 

COMMANDS 

ACCORDING 

TO TRAINING 

MISSION TYPE 


! ! 




EXECUTE MOTIONS 
DEFINED BY ' 
MOTION COMiWID 
TABLE 


VERIFY 
ACTUATOR 
, DISPLACEMENT j 


FIGURE' 8 . 5-4 STEP INPUT CHECKOUT MODULE 


MOTION 

EXECUTED 


WITHIN LIMITS 


OUTSIDE 

LIMITS 


MESSAGE: \ 

INCORRECT ' 
RESPONSE TO 
MOTION COMMAND/ 
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FIGURE 8.5-5 FREQUENCY RESPONSE CHECKOUT MODULE •[ j~- - 
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l 5 . 4 Recommended Checkout Approach 

7 The major difficulties in the testing of a hydraulic motion base of jthe type 
expected in future simulators for the NASA is the potential for damaging the 
.extensive visual displays and other- equipment mounted on the motion base. The 
proposed techniques have examined the merits of various stress levels to which the 
motion base could be driven during transient response testing. Although, if a 
system exhibits truly linear performance, it is not necessary to test 'at any other 
than a nominal level to evaluate the transient response, there are other factors' 
present. The frequency response of simulator motion bases of even the size 
considered here have the potential for extending beyond ten hertz. Consequently, 
it is a practice to filter all commands to the motion base to assure that it 
is never driven at those high frequencies with any substantial magnitude. This 
filtering, which may not be bypassed for testing, masks the dynamic response 
properties of the remaining hardware in the range where malfunctions are most 
likely to be revealed. Consequently, testing to stress levels comparable to 
daily training requirements is designed to at least assure system capability to 
_achieve these levels. 

J 

The above difficulties have prompted us to suggest the following approach 
to motion base test implementation. First, it is recommended that maximum use 
be made of instrumentation which may be monitored on a day to day basis by an 
automatic self test system. Currently available sensors that would be applicable 
are summarized in Table 8.5-5. Sensors of .this type can even be used to implement 
testing for incipient fault detection purposes as summarized in Table 8.5-6. 

In addition, it is recommended that consideration be given to development of 
the on line monitoring techniques described in Section 7. These techniques have 
the potential of providing frequency response data from analyses of system 
. performance recorded during normal operation. Use of these techniques to minimize 
the unnecessary streesing of motion base mounted simulator components seems like 
an' ideal application for these concepts. 
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..-W 

WNSOR 

HARDWARE 

— 2 

ACCURACY . M 

PERCENT OF 
FULL SCALE 

sz 

^ OUTPUT 

COST 

, , 

REMARKS 

J 

3000 PSIG 
HYDRAULIC OIL 
PRESSURE 

DYNISCO 
PT 320B-3M 

+ 0.5% 

0-5V 

235.$ 

DYNISCO DIVISION 
OF MI'CRO DOT 
WESTWOOD, MASS. 
617-326-8210 

50 PSIG 
HYDRAULIC OIL 
PRESSURE 

DYNISCO 
PT 320B-50 

+0.5% 

I 

0-5V 

255.$ 

3000 PSIG 
OIL SENSOR 

0-100% LEVEL 
HYDRAULIC 
OIL 

R.F. 

BINDICATOR 
PRIMCO MODEL 
770 

+0.5% 


945.$ 

NOR-TEC INDUSTRIAL 
SALES 

• HOUSTON, TEXAS 
713-644-8026 

CAPACITANCE 
BINDICATOR 
CAP-LEVEL 
MODEL 660 

+1 . 0% 

; 

j 

463.$ 

3000 PSIG 
GAS PRESSURE 

DYNISCO 

PT320B-3M 

+0.5% 

0-5V 

235.$ 

3000 PSIG 
OIL SENSOR 

300 PSIG 
GAS PRESSURE 

DYNISCO 

PT320B-3C 

+0.5% 

0-5 V 

255.$ 

3000 PSIG 
OIL SENSOR 


RESISTANCE 

PLAT. 

ROSEMONT 

152T10A 

CALIBRATION 
ACCURACY 
@ 0°C=+0.04°C 


597.$ 

ROSEMONT 
ENGINEERING CO. 
213-866-8224 

0-100 PSID 
HYDRAULIC OIL 
PRESSURE 

DYNISCO 
DPT 361 

+1.0% 

+3.MV/V MIN. 

395.$ 

3000 PSIG 
OIL SENSOR 

POSITION 

POTENT IOMETER ‘ 

HOUSTON 
SCIENTIFIC 
POS. POT. 
1800-150 

+0.1% 


475.$ 

HOUSTON SCIENTIFIC 
HOUSTON, TEXAS 
...713-681-6631 

+0.05% 

505.$ 


TABLE 8.5-5 TYPICAL HYDRAULIC MOTION BASE INSTRUMENTATION 
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TABLE 8.5-6 INCIPIENT FAULT DETECTION-HYDRAULIC MOTION BASE 


FAULT 

PARAMETER 

MEASURED 

OPERATING RANGE 
(UNITS) 

DATA 

STORED 

IFD 

TECHNIQUE 

IFD 

INDICATION LEVEL 

Blocked 

Differential 

3-30 

1 day 

Gray Area 

27 PSID 

Fi 1 ter 

Pressure 

(PSID) 

Performance 

with Max Flow Rate 

Ruptured 

Differential 

3-30 

3 days 

Rate of 

Pressure Drop 

Filter 

Pressure 

(PSID) 


Degradation 

1 PSID / Day 
with Max Flow Rate 

Damaged 

Hydraulic Pump 

1800-2200 

20 days 

Rate of 

Pressure Drop 

Pump Seals 

Output Pressure' 

(PSIA) . 


Degradation 

150 PSIA / Day 

Sticky 

Actuator 

Actuator 
Position Error 

X (Inches) 

60 days 

Rate of 
Degradation 

Average Error Increase 
0.1 Inch / Day 
for Standard Manuever 

Damaged 

Actuator Seals 

Actuator 
Position Error 

X (Inches) 

10 days 

Rate of 
Degradation 

Average Error Increases 
0.5 Inch / Day 

Ruptured Sealing 
or Piping Component 

Hydraulic 
Fluid Leak 

None 

? 

Visual 

Inspection 

Detectable Accumulation 
of Fluid External 
to Hydraulic System 


o 

<; 

re 


3 

O' 

re 
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8.6 MISCELLANEOUS EQUIPMENT 

K This section discusses self test implementation concepts for equipment 
which, although a necessary part of the simulator, are not particularly) 
visible during actual operation. This equipment is usually procured as an 
integral, self contained, ready to operate subsystem. However, these subsystems 
do require extensive, wiring installation in the simulator to provide the means 
for distribution of outputs. 

The miscellaneous equipment covered here consist of the following: 
o Aural Cues System, 

o Power Supply System, and the 

o External Clocks and Timing Equipment. 


8.6.1 Aural Cues System (ACS) 

Operational experience with training simulators supports the importance 
level assigned to auditory cues by human engineering studies. These studies 
rate aural stimuli as second in importance only to visual stimuli. The com- 
-.^plexity of modern aircraft and spacecraft has demanded aural cues components 
development to achieve a realistic simulation capability for all the various 
sounds normally heard in these vehicles. This section discusses one type of 
aural cues simulation equipment and a possible approach to the automatic self 
test of this equipment in a simulator. 


8. 6. 1.1 Aural Cues System Description. 

The system described here for reference purposes is the Poly-Voice Aircraft 
Sound Synthesizer proposed by Singer in the SMS Baseline Definition Report. 

This equipment has all the aural cue simulation capability needed to cover the 
various flight regions, flight phases, and configurations of the Space Shuttle. 
The Synthesizer, therefore, is a good representative design of the type of 
equipment that v/i 11 eventually be selected for Shuttle simulators. 

Figure 8.6-1 is a functional diagram of the Synthesizer. Sound is generated 
by the Voltage Controlled Oscillators (VCO's) or the Pseudo Random Noise Gener- 
ators (PRNG's). Volume and duration (if applicable) of the resulting audio 
are controlled by the Voltage Controlled Amplifiers (VCA's). Control.! ing 
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gommands for these modules are initiated under software control by the HOST 
lomputer and routed to the ACS through the DCE. 

•--.'Each -of the various sections of the Synthesizer has been designed, wired, and 
hardware programmed to perform a unique function in sound generation. The basic 
functions included are: 

1. Engine sound generation 

2. Aerodynamic sound generation 

3. "Clunk" , "Thump" , "Bang" generation 

4. Miscellaneous sound generation 

Engine sounds generated include thrust sound,, vibration, start-up, shutdown, 
and thrust termination noises for all engines; that is, for SRM, MPS, RCS, and 
OMS engines. By virtue of the sequence of events in the mission time line, it 
is possible to use an engine sound simulation string to generate sounds for 
various engines that are not normally operated concurrently in the Shuttle. 

a. 

| The Aerodynamic Sound generation model includes simulation of air flow and 
^structural noise as a function of vehicle attitude, altitude, and airspeed. 
Transonic and supersonic flight effects on sounds will be a part of the Aero- 
dynamic model. Popping and cracking sounds associated with re-entry are also 
included. 

The various "clunks", "thumps", and "bangs" related to events such as drag 
• chute deployment, pyrotechnic separation, and docking will be simulated by the 
"clunk" section of the Synthesizer. 

The Miscellaneous Sounds section generates sounds related to taxi pavement 
noise, landing gear activation, wheel touchdown, air conditioning duct blasts, 
fuel cell venting, and other similar, relatively smooth, continuous sounds. 

Quadraphonic installation of the speakers and sound transducers in the crew 
station is shown in Figure 8.6-2. The Speaker Output Control section of the 
Synthesizer receives commands from the computer, and in some special cases, from 
the sound generation modules, to control the relative volume of the 4 channels 
and therefore the directional characteristics of the sound simulated. 
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The aural cues will be presented within the cockpit enclosure as quasi 
j^levated (nonplanar), bilateral quadriphonics with "sound in motion" where- 
required to achieve realism in the training environment. 

The parameters indicative of ACS operational status are shown in Table 8.6-T. 
These are the characteristic parameters measured during self test to determine 
system readiness, and in -some cases, to determine the possible source of a 
failure. 


' TABLE &. 6-1- AURAL CUES SYSTEM CHARACTERISTIC PARAMETERS 


PARAMETER 

Frequency 

Timbre 

Volume 

Duration 


OPERATING RANGE 
10 to 18,000 Hz 

1 to 5 distinct harmonic frequencies 

40 to 120 decibels 

100 mil sec to continuous 


8.6.1 .2 ACS Self Test Approach 

The approach described here for ACS self test is based on the sequential 
checkout of each section of the Synthesizer to verify its ability to simulate 
those sounds assigned to that section. 

Under computer command, the section under test is directed to generate a 
particular sound. Microphones, installed in the cockpit for test purposes, 
pick up the audio signal. The microphone electrical output is digitized and 
routed to the 1/0 Interface Minicomputer (and possibly on to the HOST). Fast 
Fourier Transform processing is performed on the sampled data, and the resulting 
frequency distribution and amplitude information pattern or signature is 
compared with the stored reference signature for the commanded sound. If 
comparison is achieved within pre-defined tolerances, the test moves on to the 
next sound for the section under test, or to the next section, as required. 
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The only additional hardware required to implement the ACS self test 
^escribed above is the four -microphones , one for each of 'the four speaker and 
"transducer installations, and the necessary circuitry to route analog signals 
to-the ADC in the DCE. Additional software is described in Figure. 8. 6 t3. __ . 


Q ACST5T J 


REPEAT FOR EACH AURAL 


CUE SIMULATED v 

/ COMMAND SOUND 
/ GENERATION AND 
/ SAMPLE (DIGITIZE) 
/ RESPONSE 


± 

CALL FAST FOURIER 
TRANSFORM ROUTINE 
Compute amplitude 
response at component 
frequencies 
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8.6.2 Power Supply System 

There are two major areas in the Power Supply System. The AC portion of the 
system consists of the facility power and the power distribution and cirdu.it 
protection components. The DC portion consists of the conversion equipment, 
the distribution cabinets with terminals and switching, and the circuit pro- 
tection elements for DC supply lines. 

Facility power consists of 277/480 V, 120/208V 60Hz, 3 phase power, and 
.115 V 400 Hz, single phase power. The 227/480 V power is used to drive high 
demand motors such as the hydraulic boost pump motor. The 120/208 V power 
energizes computer equipment, visual system, and the DC power supplies used 
by other subsystems. The 400 Hz source powers various elements of the simulator 
such as the flight hardware. Overload protection implementation consists of 
the use of circuit breakers on power output lines, and the use of a predefined 
power up sequence that minimizes motor and equipment start up current demands. 

There are ‘several power supplies that convert the 120/208 V power to DC 
voltages at the levels needed to drive electronic equipment in the simulator, 
voltage levels include but are not limited to jj5, jdO, and +28 volts. The 
supply lines for this. power are also protected by means of circuit breakers, 
as well as visual and auditory alarm signals when voltages, currents, or 
temperatures exceed predefined limits. 

The basic concern of the Self Test System in regards to simulator power 
is to verify that output voltage levels are within design specifications, and 
meet the requirements of the equipment they supply. It is also important that 
self test procedures verify that none of the protective devices has tripped 
to indicate a failure or potentially hazardous condition. Therefore, prior 
to initiating self test activities in the simulator system, it is necessary 
to make voltage measurements at the various supply busses, and to verify the 
status of overload and out of limit caution and warning indicators for the 

* i 

power system. These checks can be made automatically if the DCE and other 
elements in the measuring string can be used, or manually if automatic measure- 
ments are not possible. 
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$.6.3 External Clocks and Timing Equipment 

^ Time synchronization and sequencing of mission events during training 
-'Simulation is achieved by using a Mission Elapsed Time (EMT) generator and a 
Greenwich Mean Time (GMT) generator. . In .addition to these absolute time 
generators, there are several timing si.gnals routed throughout the simulator 
in order to trigger cyclic operations, or- to synchronize execution of certain 
events such as data transfers. For example, to enable the Shuttle Mission 
Simulator to operate in real time synchronism with the Mission Control Center, 
timing signals will be provided by MCC. These signals consist of" the following: 

T pulse per minute at 66 t 2/3% duty cycle 
1 pulse per second at 80% duty cycle 
1 Megahertz at 50% duty cycle 

The SMU will use these signals to assure, synchronization with MCC related activ- 
. ities and also to generate other signals required to provide synchronization of 
events internal to the simulator. These signals are generated by the Central 
Timing Equipment and consist of the following clock signals: 128 KHz; 4-KHz; 

31.25, 25, 2.5, and 1.25 PPS for Flight Computer; 20 PPS; 10 PPS to Event Timer, 
/ ' S ^PPS, and 1 PPM. The generation of all those signals is simply a matter of 
^Jounting down in frequency and providing driving circuitry for the synchronizing 
signals received frpm MCC. 

Self Test of the timing and synchronizing equipment, as in the case of the 
Power Supply System, consists simply of measuring the various timing distribution 
busses and verifying that the signal received is of the frequency and amplitude 
specified. Frequency and w ave shape integrity can be verified by Fast Fourier 
Transform of sampled, data for each of the clock signals except those that exceed 
20 KHz as this -is the upper frequency which can be accurately sampled and analyzed 
using operational capability of ana-log DCE. 

For the higher frequencies, some specialized hardware would be required to 
either perform the total processing and notify the test control computer of go or 
no-go status 'in the clock signals, or hardware to digitize clock signals and then 
feed them to the computer in an expanded time scale for analysis. In either case, 
the higher frequency clock signals can be checked as part of the hardware verifi- 
cation activities on the simulator. 
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INTEGRATED SYSTEM SELF TEST SUMMARY 

In the previous sections, we have discussed the nature of the simulator hard- 
ware, the types of tests that are of interest for automatic implementation, the 
various generic techniques that are available for accomplishing the desired test 
results, and the hardware and software requirements for implementing each of these 
tests for each of the simulator subsystems. In this section, we will consider 
the overall sequencing of the tests for all of the simulator subsystems, as well as 
the executive software requirements and structure. We will also summarize the 
hardware and software requirements and will then use the results to consider the 
impact on the simulator system in terms of both a data base impact and a hardware 
cost impact. 

In Section 9.1, we consider test sequencing requirements in order to implement 
in an integrated manner all of the subsystem tests previously described to 
accomplish the fault detection, fault isolation and incipient fault detection 
^motions as required. 

In Section 9.2, we address the implementation of this test sequence by 
description of an appropriate test software executive and discuss the assumptions 
that this design is based upon. 

The hardware required is summarized in Section 9.3 and the data base impact 
of the test software, considered in total, is discussed in Section 9.4. The cost 
impact of the total hardware requirements is addressed in Section 9.5 and the 
impact of simulator system changes on both hardware and software is addressed in 
Section 9.6. 
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Q.l SIMULATOR SELF TEST SEQUENCING 

^ Testing of the simulator as an integrated system involves the sequential 
and sometimes concurrent verification of simulator subsystems and functions. 

- There are three hierarchical classifications of tests determined by the level ■ 
of detail to which the test is performed and the level of confidence obtained 
after successful completion of the test. These classifications are Readiness 
Tests, Fault Isolation Tests, and Incipient Fault Detection Tests. 

Readiness Tests are used to verify the readiness of simulator subsystems 
to perform according to design and operational requirements. Generally these 
tests check each of the simulator subsystems and, whenever possible, use 
already verified subsystems to check other subsystems of the simulator. Ideally 
readiness tests are end to end tests. They are primarily concerned with test- 
ing a complete string of hardware. 

The sequence of subsystem testing developed in the course of this study 
^ is based on the "building block" approach of establishing the operational 
^readiness of a system element before that element can be used to test other 
"'""portions of the system under test, in this case the simulator. Figure 9.1-1 
shows the sequential and parallel arrangement for test execution during the 
Readiness Test. Individual tests shown at the same horizontal level can be 
executed simultaneously by .the various relatively independent processors in 
the simulator. Checkout of the HOST computer is required prior to commencing 
with simulator checkout. 

Each of the vertical strings indicate dependence of tests, lower on the 
chart, on successful completion of previous tests. For example, the 'simulator 
interface minicomputer must pass successfully its readiness self test prior to 
executing the routines for DCE self test. Failure of the minicomputer to pass 
this test would return information to the HOST regarding the point or function 
at which the test failed. On the other hand, a failure in the DCE would prevent 
Crew Station or Visual Simulation system checkout; and it would be up to HOST 
computer software to determine what automatic fault isolation tests should 
be run on the DCE. 
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FIGURE 9.1-1 READINESS TEST ELEMENTS AND EXECUTION SEQUENCE 
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^ The self test software is initially in mass storage elements of the HOST 
computer complex, and is loaded into the system under control of and 
through the interface facilities of the HOST computer. At the conclusion of 
the load, each processor returns to- the HOST a message indicating that the - 
load has been completed, and some other information such as a checksum which the 
HOST can then use to verify that a successful, accurate load has been accomplished. 

After the loading process is completed, and the HOST has verified that all 
went well, each processor is commanded by the HOST to execute the subsystem 
Self Test programs. 

The simulator processing elements that receive this self test software 
load are the Flight Hardware Interface Device processors; the simulator inter- 
face for the DCE, crew station, visuals, and motion base; and the IOS Graphics 
minicomputer. Testing of the Flight Computers is not performed until after 
the FHID is thoroughly checked out; therefore,^ loading of the Flight Computer 
-self test software does not take place until after completion of -FHID Self Test, 
ftn s' particular sequence is necessary because FC Self Test requires correct 
performance of FHID hardware not only during the load, but also in checking 
FC capability to communicate with avionic components external to the FC and 
simulated by the FHID. 

Completion of each level of Readiness Tests results in control being returned 
to the HOST, which then logs any subsystem operational data gathered during the 
test, issues appropriate messages to-the*Test Operator, and determines the ji^xt 
logical step in the test sequence. , . 

The readiness' tests are intended to be overall functional tests for the 
various simulator subsystems and as such should require only a limited amount 
of time to execute. It is assumed that the readiness tests would nominally be 
executed every day or at the beginning of each training shift. In the event 
that a failure or fault is detected by the Readiness Test, it may be necessary 
to execute a Fault Isolation Test in order to identify more precisely the LRU 
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nch is the source of the problem. This is only necessary in the case of the. DCE, 
ie motion base, the visual system and the aural simulations. . 

" i 

If' 'the fault isolation test is* required, then a question arises- as -to whether 
it should be executed automatically or whether the operator should be required to 
initiate the additional test by further positive action. In design of the test 
software automatic execution is assumed since this establishes the necessary basic 
sequence elements. The introduction of pauses or overriding interrupt logic is a 
relatively minor and optional problem when the software is implemented. 

Figure 9.1-2 illustrates the operational sequencing of Readiness, Fault, 
Isolation, and Incipient Fault Detection Testing. The basic data for the 
Incipient Fault Detection Test can be obtained in most cases during the readiness 
test execution as shown in this Figure. However, if a fault is detected during 
the readiness test, then the data obtained should not be entered into the Incipient 
Fault Detection data base. Tests for this contingency are shown in the software 
f 1 ows . 

A 

1 - 

In summary, then, if the Fault Isolation Tests are initiated automatically, 
the operator will be provided with an output which identifies the following: 

o Subsystems tested that have successfully completed the readiness check 

o Sybsys terns tested that have failed the readiness check 

o Results of Fault Isolations Tests for faulty subsystems 

o Results of analyses of Incipient Fault Detection Test data, including 
the following: 

o LRU’s that have moved into a gray area and are approaching 
an unsatisfactory level of performance 
o Projected failure dates/times for near term critical LRU's 

The operator must then decide whether to constrain the type of activities 
allowed in simulator usage, or to initiate maintenance or replacement of the 
components identified as failed. The output from self tests then is an indi- 
cation of the readiness status of the system, including information helpful 
in trouble shooting or restoring any faulty functions or components of the 
'imulator. 
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BEGIN 
SELF TEST 



FIGURE 9.1-2 DAILY SELF TEST SEQUENCE 
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SIMULATOR SELF TEST SOFTWARE SUMMARY 

The simulator ‘sel f test software has been designed and structured so as 
to implement the test sequences discussed in Section 9.1 with respect to both 
the order of subsystem testing and the order in which the various types of 
tests are executed. Since the simulators of interest don't exist currently 
but are expected to be multi -computer systems with satellite processors available 
to handle input/output processing, data reformatting, and other miscellaneous 
operations, it is impossible to predict with much certainty the amount of 
computing power available in these peripheral processors. Therefore, it is 
also impossible to rationalize, at this point, the distribution of self test 
functions between the host computer and the interface computers. As a result, 
the approach taken in designing the software defers that problem to a later 
time and presents the software structure so as to define hierarchies of 
software modules, and the necessary sequencing of operations and channels of 
data communication. 

A simulator self test software tree is shown in Figure 9.2-1. The software 
-^adules are identified by both an acronym, suitable for programming use, and 
a descriptive title. The modules shown in this tree do not have the relationship 
usually implied by a software tree in the sense that the modules at the two 
lower levels are not subprograms to the modules above them. Instead the impli- 
cation of the structure of the tree is that modules at the same level may be 
exercised concurrently and independently, resources permitting; all modules in 
the same string but at a higher level must be exercised successfully before 
that module may be exercised; or, in other words, the modules in a string must 
be exercised in a top down sequence. All of these modules and programs will 
be controlled in their execution by the test executive and consequently in- 
an ordinary tree would all be shown directly connected to the executive. Each 
of these modules has been described in detail in previous sections. In this 
section, we limit ourselves to describing the test executive software. 
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9,2.1 Self Test Executive Software 

* A software flow for the test executive is shown in Figure 9.2-2. The test 
Sscutive is primarily concerned with controlling the order and extent of the 
testing executed and communicating the proper output messages and data for 
operator use as well as for storage in the data base for incipient fault 
detection. The test executive accomplishes its function by initiating and 
controlling the loading of all test software from mass storage facilities, 
commanding execution of the tests, reviewing the processed results from the 
' tests and then selecting the proper course of action which will include in 
most cases, the presentation of data to the. operator, the selection of 
additional tests, the storage of historical data in data base files, and the 
printing of test data reports. 

It should be noted that the test executive does not become involved in 
the dynamic test timing function. The test data sampling rates are established 
by the test software for each subsystem being tested. Time tags for the data 
points are obtained from an external clock and are loaded into the controlling 
^omputer at the same time the data words. are loaded. This minimizes the depen- 
Jice of the subsystem tests on proper operation of all computer and interface 
timing functions and eliminates unpredictable interrupts and interrupt processing 
as an error source in test data timing. 

The executive does contain the logic to decide on the course of action 
after each level of testing is completed. This logic requires access to the 
test results temporarily stored in a memory buffer. 

When testing is completed or has proceeded to a standstill, the executive 
formats the data, if necessary, and communicates the appropriate information 
as follows: 

o Operator display - Operator action requirements, including "system ready" 
o Hardcopy printer - Daily test results summary and reference data 

o Data base file - Incipient fault data base update 
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9.2. 2 Subsystem Test Software 

The subsystem test software, such as FITST or MBTST, is loaded by the 
j^cutive, TESTEX, and includes the programming which implement's the tests, the 
Characteristic parameter data associated with the hardware being tested, and 
the date processing software required for reducing the test data. . The output 
of the subsystem test software is stored in a memory buffer for final disposition 
by the executive, TESTEX. 

There are three different types of testing/processing at the subsystem 
level. These consist of readiness, testing, fault isolation testing, and inci- 
pient fault detection processing, and are usually executed in that order. 

The readiness tests are ideally end-to-end tests or total performance 
tests for a subsystem. If a readiness test indicates a fault and fault 
isolation tests are applicable, the decision to proceed with fault isolation 
can be taken automatically at the subsystem test software level, and the logic 
is shown accordingly as part of the subsystem tests. It is recognized that 
this decision could be exercised at the executive level where the results of 
•“‘"her concurrent subsystem tests could also be considered. The decision can 
■^lo be reserved for manual selection by the operator. Final choices can be. 
made during software implementation without any significant impact on the 
software development. 

Incipient fault detection data should nominally be gathered during the 
readiness tests. If a fault is detected at that time, the incipient fault 
detection data may be adversely affected. Consequently, the decision should 
be made at the subsystem level to delete this data and not add it to the data 
base. Otherwise, the incipient fault detection data is communicated to the 
executive through the memory buffer. 
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9.3 SELF TEST HARDWARE SUMMARY 

This section summarizes the total hardware requirements to implement the 
emulator Self Test System developed in the course of the study. The hardware 
listed includes only those components added for test purposes. A primary ground- 
rule of the study was to maximize use of operational hardware in carrying out 
the Self Test job. This groundrule has been adhered to throughout the study, 
and hardware used in this manner is not specifically identified in this section. 
Cost data on Self Test System hardware is presented and discussed in Section 7. 

Table 9.3-1 is a list of the various components added to each of the sub- 
systems for Self Test purposes. Each photosensor used for galvanometer testing 
include a photodiode as a built-in light source. These devices are compatible 
with signal levels of logic circuitry used in the Data Conversion Equipment and 
therefore, no additional signal conditioning components are needed.- 

The current sensor circuits used to verify operation of lighted indicators 
are counted as a single component per indicator.' These sensor circuits contain 
jjesistors, diodes, and transistors. However, each sensor circuit can be packaged 
| an individual module and using state of the art circuit integration techno- 
logy, the circuits could be packaged right in the indicator assembly. 

The loop closure switches listed for the Analog DCE are those solid state 
switches used to connect output channels to input channels in order to verify 
DCE operational status. Also under DCE is included the necessary components, 

ADC, switches, and buffer amplifiers needed to provide input channels for 
measurements taken during the Self Test process, measurements using instru- 
mentation specifically added as part of the Self Test System. 

Table 9. 3-2. shows the breakdown of additional DCE channel requirements for 
Self Test. These requirements cover the data acquisition channels used speci- 
fically to measure characteristic parameters of simulator hardware during 
Readiness, Fault Isolation, or Incipient Fault Detection testing. No additional 
command channels were identified for applying test stimuli to operational hardware. 
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TABLE 9.3-1 HARDWARE ADDED FOR SELF TEST 

i 

COMPONENT QUANTITY 

Galvanometers (70) 

3 photosensors in each' 210 

Lighted Indicator Current Sensor Circuits 700 

Analog DCE - Loop Closure Switches 

Closure to test input channels 200 

Crew station isolation and connection of output 
channels to the 200 operational input channels 200 

Analog DCE Test Channel Components 

ADC 1 

Buffer amplifiers 120 

Solid state analog switches 120 

feilevel DCE - Loop Closure Sating and . 

Digital Input Multiplex Selection Gates 2500 

Visual Simulation System Self Test Hardware 
’Digital processing oscilloscope 1 

Signal generator 1 

Signal to noise meter 1 

Video switches -<16 

Video buffer amplifiers 36 

Motion Base 

Pressure sensors , . 5 

Level sensor 4 

Temp sensor 2 
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TABLE 9.3-2 ADDITIONAL DCE CHANNEL REQUIREMENTS FOR SELF TEST 
COMPONENT TESTED * CHANNEL REQUIREMENTS 


- , Bilevel. Analog 

Galvanometers 210 

Servometers 16 

Tapemeters 20 

ADI (4 units) 

4 wire sin/cos, 3 channels each 48 

6 pointer position feedback' 24 

signals from each ADI 

Lighted Indicator 700 


^ctromechanical Flags 400 

Switches - No extra lines for testing 


Visual Model Servos 
3 cameras x 6 servos 
Terminal area transport servos 

Orbital earth position resolver 30 

Cloud/sky/ terminator altitude servos 


Motion Base 

Sensors 11 


Position, actuators 6 


17 


’ ' 1383 

o j 

!N> 

With Spares 

1500 

125 
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"awever, in the case of the video' components of the Visual Simulation System, the 
controlling computer, with DCE, must issue the necessary commands to re- 
configure the test hardware and control the test execution. These commands acti- 
vate the DPO, signal generators, and measuring equipment used to test, video 
elements. The number of these commands is relatively small {less than 20) and 
represent negligible impact on the total DCE. 

On the other hand, the additional input channel requirements of 1500 bi- 
level and 125 analog channels for Self Test purposes represent an effective 
doubling of DCE capability. when compared with the Reference Configuration 
magnitudes of 2000 bilevel and 100 analog channels. Considerable increase 
in parts and manufacturing cost should be expected from the fact that the in- 
crease in DCE capability is more accentuated on the analog instead of the bilevel 
side of the DCE. Analog channel components are larger, more complex, and more 
costly than the gating required to add bilevel channels. 


Additional test hardware for the Visual Simulation System consists 
/the Digital Processing Oscilloscope, a video test waveform generator, a 
signal to noise meter, and the necessary switching to isolate each LRU 
during the testing sequence. No additional hardware is expected for testing 
model scene generation equipment other than-. that. 1 isted- under DCE. 


The Motion Base test hardware consists of the sensors and signal conditioning 
circuits required to route characteristic parameter data to the computer. Normally 
these parameters are only routed to the maintenance panel either electrically, 
mechanically, or hydraulically. In order to implement the automatic Self Test 
capability developed in this study, it is also necessary to digitize charac- 
teristic parameter data and supply them to the computer conducting the test. 

The amount of hardware discussed above is a significant measure of the 
impact on simulator design and maintenance by the addition of automatic Self 
Test. Cost data related to this impact is discussed in Section 7. However, 
at this point it is important to point out that parts cost is a small part of 
tal impact when compared with the total cost that includes generation of 
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-dditional wiring instructions, manufacturing additional housing space for these 
proponents, actual wiring cost, and increase in acceptance and' integrated test- 
ing of the resulting system. All of these costs, however, may be offset ^by the 
increase achieved in simulator availability and utility during the operational 
life of the system. They also represent a very small percent increase to 
simulator total procurement cost. 
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9.4 DATA BASE IMPACT 

^ The impact on a data base system of the self test software requirements 
described throughout the report for the various simulator subsystems can be 
assessed in terms of the software loading (instructions plus data) imposed on the 
system. Since these size parameters are highly dependent on the specific 
configuration being considered, we will address the software loadings in terms of 
each of the individual subsystems. 

The flight hardware interface device may be a custom built unit incorporating 
standard circuit modules or it may be derived from a high performance minicomputer. 
In either case, the components of the interface system are basic in nature and 
configuration to a simple computer structure. It is convenient to consider the 
test software for the interface device as if it were a minicomputer and to assume 
as an approximation that the flight computer test software is also similar to 
minicomputer practice.' Based on data from a typical vendor, the following software 
loading is associated with the particular test software noted: 

Storage Required 

Test ■ (Decimal locations) 


ALU 

1000 

Memory 

500 

Instruction execution 

1800 

Instruction timing 

1800 

Real time clock 

600 

Total 

5700 


Rounding off the estimate and recognizing that essentially different software is 
required for the two units, it can be estimated that the software required for the 
flight computers and their interface will total about 6000 decimal locations each 
or about 12,000 locations total. 

Software loadings imposed by the data conversion equipment test software 
should be nominal for a system that is designed with current technology as an 
integrated system. Requirements for older systems or systems derived from 
available equipment rather than newly designed systems can be expected to pose 
.greater problems and require more software. For the proposed tests, the tolerances 
required 'can be expressed as percentages which reduces data requirements substantial 
although scale factors may still be required for the analog channels. These 

'•ir 
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parameters represent a minor part of the required software which should consist 
j^argely of problem logic. An estimate of 2000 locations for data and instructions 
should be ample. 

The control and display software excluding the graphics display test software 
totaled 1600 locations including floating point data and instructions. The data 
requirements are extremely conservative in this estimate since it was assumed a 
unique set of hardware characteristics was associated with each analog hardware 
device although many of these devices may be physically similar. 

Visual subsystems software requirements are extremely hard to estimate 
although they should not be expected to be overly large. This is because the 
proposed approach relies on hardware signal generators for test signal generation. 

The data requirements and software complexity are a function of the type of color 
TV systems implemented, how many separate strings of television hardware are 
inolved, whether they are all alike or different for different scenes, and many 
other factors. Nevertheless, software requirements should be quite modest and 
2000 locations should be adequate for the necessary logic and the minimal amount 
,!lif data. 

Motion base software requirements are extremely minimal. The software required 
to accomplish static power on and power off checks should not amount to more than 
500 locations including data. If a more sophisticated analysis is implemented, using 
Fast Fourier Transform, this software does not consume much memory for itself; 

300-400 locations is a reasonable estimate. 

Totaling the above major items' of test software produces a grand total of 
about 18.5 thousand locations. 
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-5 SELF TEST SYSTEM RELATIVE COSTS 

Relative cost data for addition of automatic self test capability to! the 
Reference Configuration Simulator is shown in Table 9.5-1 . No absolute dollar 
figures are shown because the selection of test component configuration, packaging, 
manufacturing, and installation techniques are dependent on the actual simulator 
design used, as well as the date in time when self test system implementation 
is to take place. 

The first column shows cost' of self test system elements relative to the 
basic cost of the subsystem to be tested. This rating ranges from Negligible 
(0-5%) to Moderate (20-30%). No "Hi'gh" ratings were given to self test cost 
for any subsystem as this rating would have implied greater than a 50% increase 
in cost of the basic system. Consistent utilization of existing operational 
capability in the system for self test purpose is the basic reason for maintaining 
cost between Moderate and None. 

The five columns to the right of the Table show cost of different factors 
implementing subsystem self test as a percentage of total Self Test System 
'cost. Some of these factors are estimated as less than 1% and therefore are 
shown only as *. The total cost of the Self Test System adds only to 98%; 
the remaining 2% is accounted for in the * items and others which exceed the 
whole number shown. 

The largest percentage of Self Test System cost appears in Visual Simulation 
CCTV Self Test. This high percentage is due to the cost of the Digital Processing 
Osscilloscope, the special video pattern test signal generators, and the various 
signal and noise meters. The cost of visual simulation video component self 
test is further increased by test software development cost. This software is 
relatively more sophisticated than other elements of- the test software in that 

it must provide processing capability for various complex waveforms from the 

•» 

video string. These waveforms have. a variety of frequency components, require 
sampling rates of up to 50 Megahertz, and- include- test patterns such as a stair 
step and frequency multiburst signals. 
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TABLE 9.5-1 RELATIVE is tu FACTORS OF SELF TEST SYSTEM 


SUBSYSTEM ■ 

SELF TEST COST , 
RELATIVE TO 

SIMULATOR 
SUBSYSTEM COST 

SELF TEST COST RELATIVE TO TOTAL 

SELF TEST 

SYSTEM COST 

DESIGN 

FABRICATION 
& ASSEMBLY 

HARDWARE 

COMPONENTS 

SOFTWARE 

TOTAL 

PER SUBSYSTEM 

ANCILLARY COMPUTERS 

LOW 

2 

* 

1 

5 

8 

FLIGHT HARDWARE 

NEGLIGIBLE 

1 

1 

1 

2 

5 

CREW STATION AND I OS 

MODERATE 

3 

3 

5 

10 

21 

ANALOG DCE 

MODERATE 

1 

2 

3 

3 

9 

BILEVEL DCE 

MODERATE 

1 

3 

1 

3 

: 8 

VISUAL SIMULATION-CCTV 

NEGLIGIBLE 

3 

3 

11 • 

9 

26 

VISUAL SIMULATION-MODELS 

NEGLIGIBLE 

2 

* 

2 

4 

8 

MOTION SYSTEM 

LOW 

1 

1 

3 

5 

10 . 

AURAL CUES SYSTEM 

MOD- LOW 

1 

■* 

* 

2 

3 

* Items that are less than 1% of total Self Test System cost 
** 2 t remain to cover costs not indicated numerically 

- 

TOTAL 

** 98% 
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Following closely in percentage of cost is the Crew Station and I0S self 
J -est factors. The high cost of controls and displays checkout is owed to the 
prge number and variety of components to be tested, which in turn requires a 
fairly large characteristic parameter data base. In addition to the data base 
software,. a .general i zed routine must be developed for each of the types -of 
components used. Each component must be tested individually and therefore 
r.equires its own unique test 'calling and control sequence. With component 
count in the hundreds (thousands, if switches included), it can be seen that 
these sequences make up a considerable amount of software to be written, 
integrated, tested, and documented. Also, the large number of ‘components 
affect design, manufacturing, and test component costs to make Crew Station 
and I0S self test a high portion of total Self Test System cost. 
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,6 SELF TEST SYSTEM IMPACT BY REQUIREMENTS OR DESIGN CHANGES 

i This section discusses various types of changes that can occur aftej- the 
simulator has become operational and the sources of changes. Particular 
attention is given to the impact of these changes both on the Simulator 
System as well as in the Self Test System. This discussion is the basis for 
assessing the effect of changes on the operational simulator and Simulator 
Self Test systems, and for formulating some recommendations that could 
minimize impact. 

9.6.1 Sources of Change . 

As indicated above, this section only deals with changes initiated after 
the simulator has been installed, accepted, and is in its operational phase. 
Changes during design or development of the simulator per se are not considered 
here, because these changes are allowed a greater impact than those during 
the operational phase, and also because when considering the implementation 
of development changes, the impact of these changes on other parts of the 
system is evaluated before permitting implementation. 

>/ 

The major sources of changes during the operational life of the Simulator are: 

1. Mission peculiar requirements variation from flight to flight. 

2. Vehicle design changes. 

3. - Advancements in state of the art and 

4. Performance enhancements. 

These sources of change are discussed below, 

9. 6. 1.1 Mission Peculiar Requirements Variations 

The primary mission of Shuttle simulators is to provide a training facility 
for the various piloting and mission oriented crews that will man Shuttle 
controls during the life of the program. Although the aerodynamic and vehicle 
performance characteristics will not vary considerably from flight to flight, 
it is reasonable to expect significent changes in mission objectives, payload 
management requirements, and general procedures as dictated by the type of 
trajectory, orbital characteristics, and manuevering requirements needed to 
accomplish these - mission objectives. 
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Mission related changes manifest themselves in the Simulator in the need 
jfor special payload management controls, payload related math models, and 
-.-development of procedures that permit efficient utilization of vehicle and 
payload systems in accomplishing mission objectives. A dramatic example of 
mission related Simulator changes is the addition of payload environmental 
control and life support management facilities in the crew station, as well 
as the addition of math model restrictions in payload manipulation when 
changing Simulator configuration from a Shuttle carrying only unmanned pay- 
loads, to one carrying a mix of manned and unmanned payloads. 

9. 6. 1.2 Vehicle Design Changes 

This source of Simulator changes is more difficult to visualize at this 
point in the Shuttle program. The design of the vehicle is an ongoing effort, 
and additions and changes are taking place on a daily basis. It would be 
ideal if this process could achieve an optimal configuration prior to the • 
first space flight; however, experience in previous programs has shown 
otherwise, and therefore, it is reasonable to expect design changes to take 
place as problems become more apparent during early flights of the Shuttle. 

J 

Design changes may affect vehicle performance or payload accomodation 
facilities and consequently alter the control and displays layout in the 
crew station, as well as the looks, feel or sound of -related cues. 

9. 6. 1.3 State of the Art Advancements 

Even more difficult to visualize than vehicle design changes are those 
modifications that result from advances in the state of the art of simulator 
hardware. Generally, these modifications result in the replacement of multiple 
components for an integrated system that performs the same job more effectively. 
Effectiveness in this case refers to fidelity of simulation as a primary 
intention, and cost of operation when compared with the price of implementing 
the change. 

9. 6. 1.4 Performance Enhancement 

The fourth source of simulator modifications is the need to improve perfor- 
-mance of the simulator beyond that which was specified, and supposedly met as 
hown by acceptance test results. Again, the primary consideration in this 
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case is fidelity of simulation. The situation may develop such that although 
|jthe simulator performs as specified, it does not present realistic cues to the 
'crew so that positive training can take place in an environment that truly 
represents the vehicle in looks, feels, sound, and performance; consequently, 
modifications are needed to enhance the simulation capability of the system. 

Performance enhancement changes would generally manifest themselves in- 
the installation of new equipment, or replacement of existing components with 
units that have more capability. These changes would usually result in an 
increase of complexity in the simulator system, and therefore increase the 
need for control as well as data acquisition channels in quantity and sometimes 
in capability. 
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9 6< 2 impact of Simulator Changes 

implementation of changes on the simulator system requires, additions , 
deletions , and reconfiguration of hardware and software. This impact willl affect 
simulation as well as self test elements. In many cases, also, the character- 
istic parameter data base will be impacted. Table &.2-1 itemizes the impact 
of various changes on the affected elements of the system. 


The impact analysis for changes in interface minicomputers, visual simu- 
lation, and motion base is unnecessary since changes in these subsystems are 
unlikely after simulator acceptance. These subsystems are Targe, complex, 
and generally the subject of individually managed procurement efforts. This 
special attention in procurement yields comprehensive requirement specifications 
for components that are reliable, maintainable, and capable of meeting future 
needs of the simulator 


The Crew Station and IOS control and display elements may be changed 
either by vehicle changes, mission requirement changes, or the need to improve 
fidelity of simulation. Flight hardware used as part of the simulator system 
by also be the subject of change by either of the reasons mentioned above. 

The changes shown on Table 9.6-1 for the DCE generally result from changes in 
Crew Station and IOS controls and displays or in simulator Flight Hardware. 
Minor changes may develop to take care of needs for additional control or 
instrumentation of simulator functions. 

Notice that the changes discussed may originate from needs to modify the 
simulation system, or from needs to modify the simulator Self Test System. 
Changes in one system generally impact configuration of the other system. 

This relationship is shown in the Table. Also, it should be noted that the 
characteristic parameter data base, as expected, is only affected when new 
hardware is introduced into the system, or when some hardware is removed or 
replaced. 
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TABLE 9.6-1 IMPACT OF SIMULATOR CHANGES 


. ‘ TYPE OF 
SIMULATOR CHANGE 

IMPACT ON . 
SIMULATOR HARDWARE 

IMPACT ON 

SELF TEST HARDWARE 

IMPACT ON 

SELF TEST SOFTWARE 

IMPACT ON 
CHARACTERISTIC 
PARAMETER DATA BASE 

CREW STATION/TOS 



• 


o ADD CONTROL OR 

o Panel Modification 

o Add sensors ' - 

o Add calling sequence 

0 Add new component 

DISPLAY COMPONENT 

o Add command and 

o Add stimuli hardware 

for self test routines 

characteristic 


response channels 


for new component 

parameter data 

o CHANGE CONTROL OR 

o Mi nor. Maybe require 

o Minor, if any 

o Minor, If any 

o Change parameter 

DISPLAY COMPONENT 

changes In mounting 



data 


hardware 




, o DELETE CONTROL OR 

o Reconfigure Panels 

o Minor removals 

o Delete calling sequence 

o Remove parameter 

DISPLAY COMPONENT 


’ 

for deleted component 

data 




self .test 

■ 

DATA CONVERSION EQUIP 



• 

• 

o ADD CHANNELS - 

o Add wiring, cabling, 

o Add loop-back channels 

o Extend channel check 

o Add new channel 

ANALOG OR BILEVEL 

. Urivers/recelvers.buf- 

and switches to check 

range In calling sequence 

numbers & special 


fer amps & mux gating 

new channels 

to include new channels 

characteristics, 


* • 


, 

if any 

o REASSIGN CHANNELS 

o Implement wiring or 

o None — 

o None'-- ' 

o None — 


patching -changes 




FLIGHT HARDWARE 


‘ 

. 


o USE ACTUAL HDWE 

o Add I/O channels 

o Minor, if any 

o If Hdwe added Is dlf- 

o Add parameter 

INSTEAD OF SOFTWE 

o Possibly add I/O 

o Possible additional 

ferent from other In 

data. for new 

SIMULATED HDWE 

minicomputer 

sensors & instrumen- 

simulator-need new Self 

hardware 


o HOST I/O configur- 

tatlon 

Test routines 


, 

ation modifications 

' 

o Otherwise only need 





test calling sequence 


o CHANGE FLT HDWE 

o Only that required 

o May require 

o Minor 

o Change data base 

IN SIMULATOR 

to implement flight 

different sensors 


to reflect new 


hardware change 



hardware 

o DELETE ACTUAL FLT 

o Decreased requirements 

o Minor reduction 

o Problem changes from 

o Characteristic 

HDWE. MAYBE REPLACE 

by deletion of flight 


hdwe verification to 

parameter data be- 

WITH MATH MODELS 

hardware 


performance verification 

comes part' of math 


* 

1 


model data base 
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SECTION 10 

CONCLUSIONS AND RECOMMENDATIONS 

The following general conclusions and recommendations have been derived during 
the course of the Hardware Verification Task and based on the data that was reviewed 
or derived. ■ - - 

e Extensive test software is expected to be available for the flight computers, 
the flight computer interface device, and any ancillary minicomputers that 
may be incorporated into the simulator systems. This software should be 
specified as part of the procurements of this equipment and utilized, by the 
computer user as best fits the context of his operations. 

e Test software for the data conversion equipment is already in use at the 
center. The switching techniques considered for the present study may be 
useful for future simulators. 

o Instrumentation of the control and display devices in the crew stations is 
feasible. The value of instrumentation of these- devices must be decided on 
an' individual basis but there is no question that such test facilities are 
most economically and effectively provided as part of the initial simulator 
procurement. 

o The video equipment in the visual simulation can benefit from recent 
advances in oscilloscope technology for implementation of self test 
techniques or for provision of test facilities for maintenance personnel. 
Provision of test capability should be considered when visual systems are 
procured. 

e Motion base equipment is subjected to frequent response testing at several 
facilities. If the response of the motion base system is restricted by 
a filter, the value of such testing is .limited. Sampling of system 
parameters with proper instrumentation may be an adequate substitute. 

o Testing of- the simulation of aural cues can benefit from readily available 
. Fast Fourier Transform techniques for analysis of the spectral response of - 
the synthesized sound. 

© The software impact on a. data base system of implementation of the complete 
gamut of tests 'considered' is nominal in-terms of magnitudes of software 
generally associated with a data base as well as relative to future 
simulation software loads. 
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APPENDIX A 

SIMULATOR REFERENCE CONFIGURATION COMPONENT LISTING 


The listings in the following pages summarize the numbers of various 
components expected to be present in various simulator subsystems. These 
components represent the types and quantities of devices likely to be present 
in future NASA simulators, but not necessarily in any specific simulator. 


A-2 


MCDONlSIEt-L. DOUGLAS ASTROMAUTMCS COMF>AtUY - EAST 



j.sv3 - A.mv.diA /00 soij.nvntosij.sv s\/~is>noa i~i3tviMOcicnM 


QTY 

DEVICE 

DESCRIPTION 

REMARKS 


- CREW STATION - 



7 

Graphics display 

CRT, Includes graphics, character, 
and refresh hardware. Serial data 
Input, maximum transfer rate of 40 
microseconds/32 bits multiplexed 
to each CRT. 

Flight hardware* Data path and interface 
to the host computer separate from the 
crew station. 

TO 

Digital display 

7-segment numerical displays. . 
Requires 4 bits per digit input. 
3, 4 and 7 digits per display. 
Decimal digits. 

Flight hardware 

j 400 

Lighted Indicators 

Includes indicators In push button 
switches. 

Flight hardware 

20 

Lighted Indicators , 

On-off discrete ' . 

Flight hardware 

.2 • 

Flight Director Attitude 
Indicator 

' 

Pitch, yaw, roll 4-wire sln/cos 
Inputs, 400 hz, 360° movement. 6 
pointers DC Input. 

Flight hardware. Digital-to-resolver 
circuitry required for drive. 

2 

Horizontal Situation ] 

Flight instrument 
modified to accept DC inputs. 

* ’ 4 

Simulated flight hardware 

t 
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QTY 


DEVICE 


DESCRIPTION 


REMARKS 


2 

2 

Air Speed/Mach Indicator 
Vertical Speed Indicator 

Flight Instrument 

modified with DC servo systems to 

accept DC Inputs. 

Flight Instrument 

modified with DC servo systems to 

accept DC Inputs. 

Simulated flight hardware 
Simulated flight hardware. 

2 

Radio Altimeter 

DC inputs 

Simulated flight hardware 

2 

Barometric Altimeter 

Flight. Instrument 

modified with servo systems to 

accept DC Inputs. 

Simulated flight hardware 

2 

Angle of Attack Indicator 

DC inputs 

Simulated flight hardware 

2 

Normal/Longitudinal 
Acceleration Indicator- 

Flight instrument 

modified with DC servo systems to 

accept DC Inputs. 

Simulated flight hardware 

2 

Aero Surface Position . 
Indicators 

, DC Inputs, DC Meters 

Flight hardware 

2 

Sideslip Indicator 

DC Inputs 

Flight hardware 

40 

Vertical Meters 

DC inputs, + 2 % accuracy 

Flight hardware . . 

5 ■ 

Horizontal Meters. 

DC Input, + 2 % accuracy. 

Flight hardware 

20 

Tape Meters . 

DC Input, +2% accuracy 

Simulated flight hardware 

10 

DC Meters 

DC Input,- + 2 % Accuracy ' 

Flight hardy/are 

200 • 

Flags 

2 position, discrete Input 

Flight hardware 

10 

Flags 

2 position, discrete Input 

■ 

1 

Flight hardware 

i 

- - - - - ’ 
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QTY 

DEVICE 

. .DESCRIPTION 

REMARKS 

4 

Attitude Hand Controller 

Pitch, yaw, roll, two levels of 1 
discretes, proportional analog 
outputs, 400 hz,' 

Flight hardware 

4 

Rudder Pedals, with Force • 
feel Simulation 

I 

Analog output' proportional to 
position, analog -input proportion- 
al to surface pressure. Electro- 
hydraulic control loading servo, 
contains strain gage load cell, 
potentometer amplifer, power sup- 
plies. Hydraulic power from motion 

Flight hardware with force feel 
simulation 

- 

- 

b$se system. 


2 

Translation Hand Control! ei* 

Lateral, vertical, longitudinal', 
two levels of discretes, propor- 
tional analog outputs, 400 hz. 

Flight hardware 

3 

Throttles 

Proportional analog, outputs, DC. 
Electric motor driven servos, 

. position sensing unit and slip 



t 1 

clutch.. 


50 

Potentiometers' 

Proportional analog outputs, DC ■ 

Flight hardware 

75 

Pushbutton Switches 

On-off', one discrete output 

Flight hardware 

TO 

0 

Pushbutton Switches 

On-off, one discrete output 

Flight hardware 

TO* 

Toggle Switches 

2 position, on<5 discrete output, 
microswitch 2TL1 , 2 pole. 

Flight hardware *. 

250 

Toggle Switches, 2 posltior 

On-off, one discrete output, 
Microswitch 2TL1 , 2 pole 
On-off-on, ttoo discrete outputs,* 
Microswitch 2TL1 , 2 pole 

Flight hardware 

350 

3 posltior 

Flight hardware 

400 

Circuit Breakers 

On-off, resettable, one discrete 
out, one discrete in. 

Simulated flight hardware 

* * ^ 
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QTY 

. DEVICE 

DESCRIPTION 

REMARKS 

15 

Rotary Switches 

9 f 7, 6, 5, 4 and 3 positions 
discrete outputs 

Flight hardware 

l" 

Audio Output Devices 

Intercom built like flight 
hardware 



Coimiuni cation System 

S-band, VHF-1 , VHF-2, Intercom, 
caution/warning tones, Tacan, 
and ILS. Includes white noise 
generators, ocillators, switching, 
and voltage-controlled attenuators 
Computer controlled attenuation, 
switching, and noise level. 



- INSTRUCTOR/OPERATOR - 
STATION 

• 


6 

Graphics display 

Inter-active CRT and keyboard, 
Iricludes .graphics and alphanumeric 
capability. A minicomputer with • 
16K 1.0 microsecond max. memory 
interfaces the terminals with the 
host computer. 

Commercial hardware 

, t 

10 

' 

Digital display 

7-segment numerical displays,- 4 
bits per digit input. 3, 4 and 7 
digits per display. Decimal 
digits. 

t 

Parallel to crew station displays 

300 

Lighted Indicators 


Parallel to crew station indicators 

100 

Lighted Indicators 

0 

, \ • 

Includes- indicators in pushbutton 
switches 

i 
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QTY 


DEVICE 


DESCRIPTION 


REMARKS 


2' 

Flight Director Attitude 
Indicator (or equivalent) 

Pitch, yaw, roll 4-wire sln/cos 
Inputs, 400 hz, 360° movement. 

6 pointers DC Input. 

Parallel to crew station Instruments 

2 

Horizontal Situation 
Indicator 

Flight Instrument 
modified to accept DC inputs. 

Parallel to crew station Instruments 

2 

Air Speed/Mach Indicator 

Flight Instrument 

modified with servo systems to 

accept OC inputs. 

Parallel to crew station instruments 

2 

Vertical Speed Indicator 

Flight Instrument . 
modified with servo .systems to 
accept DC inputs. 

Parallel to crew station Instruments 

t 

2 

Radio Altimeter 

DC Inputs 

Parallel to crew station Instruments 

2 

Barometric Altimeter 

Flight Instrument 

modified with servo systems to 

accept DC Inputs, 

Parallel to crew station. Instruments 

2 

Angle of Attack Indicator 

DC inputs 

Parallel to crew station instruments 

2 

t 

Normal/Longltudlnal . 
Acceleration Indicator 

Flight Instrument 

modified with DC servo systems to 

accept. DC inputs, 

Parallel to crew station instruments 

2 

Aero Surfage Position 
Indicator 

DC inputs, flight hardware 

Parallel to crew station. Instruments 

2 

Sideslip Indicator 

DC Inputs, flight hardware 

1 

Parallel to crew station Instruments 
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QTY 

DEVICE 

DESCRIPTION 

REMARKS 

20 

Vertical Meters 

DC Inputs, +2% accuracy 

Parallel to crew station • 

5 

Horizontal Meters 

DC-inputs, + 2 % accuracy 

Parallel to crew station 


DC Meters 

DC inputs +..2% accuracy • , 

Parallel to crew station 

£»|ygS 

Flags 

2 position 

Parallel to crew station 

IV 

Potentiometers 

DC analog output 



Pushbutton Switches ■ 

On-off, one discrete output. 


H 

DC Meters 

DC' inputs, + Z% accuracy 

Indicates direction of rotational hand 
controller. 


- VISUAL SYSTEM - 

• 


1 

* 

Star Scene . * 

Computer generated image, display 
format same as CCTV. Navigation 
stars + 3 arc min., other stars + 
15 arc min, position. 


i. 

Orbital Earth scene . 

Pitch, yaw, roll of spacecraft by 
servo driven prisms, D/’R, 400 Hz. 
Globe 15 bit digital servo with 
shaft encoders, CCTV, +1/2 min. 
arc. 

More flexible and easier to. maintain than 
film strips. Film strips difficult to 
synch for various windows. . , 

i . 

Rendezvous and Docking 

Computer generated image, display 
format same as CCTV. 

• 

i 

Landing Scene 

TV/model, terrain map, 40^x 40"', 
3000: 1 scale, 0.08" closest 
approach, D/R 400 Hz servos. 

* ! 

♦ 

* ’ # 
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QTY 

DEVICE. 

‘ 

■ • DESCRIPTION 

REMARKS 

1 

Payload Handling Scene 

Computer Generated Image, display 
format same as ‘CCTV. 

■ 

1 

Cloud Cover and Terminator 

TV/Transparency, large rear pro- 
jection, hemispherical screen, 
film strip projector 

Image high altitude, orbital and 
ascent sky/cloud scenes 

5 

TV Cameras 

1248 lines, 3 channel optical ‘ 
probes, color 


11 

TV Monitors 

25" shadow mask CRT, 1248 lines, 
900 line resolution center, 50 MHZ 
bandwidth, color 



Video signal Processing 

* , \ 

Mixes ea.rth, cloud/sky, target/ 
payload/RMS, and star field. 
Contains keying for selective 
blanking. Camera selection, 
display 'selection. 


3 

Film strip Projector 

• 

Image high altitude, orbital and 
ascent sky/cloud scenes on a rear 
projection screen. 

. 

4 

Aural Simulation 1 

i 

Poly-Voice aircraft sound synthe- , 
sizer, consists of voltage con- 
trolled function generators with 
amplifiers and speakers, estimated 
40 analog inputs. 

; 

Limited to environmental sound 
simulation. . 
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QTY 

DEVICE 

• DESCRIPTION ; 

REMARKS 

S 

- MOTION BASE SYSTEM - 
Hydraulic Elements 

* J,*. ' 

.6 DOF 6Q' stroke 

. 
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QTY 

DEVICE 

J 

DESCRIPTION 

REMARKS 

. - 

6\ 

Servo Control Components. 

DC linear system, each axis position 1 


* ' ♦ 

and velocity, and Vertical and lateral 


} 

acceleration fed back to computer • 

* 


- DATA CONVERSION - 
EQUIPMENT 


• 

! * 

Analog to Digital 
Converters 

12-15 bits, 0.25^-0.025% accuracy, 
+10v, 50 Khz conversion 

Families of converters tc meet 
application 

200* 

Digital to Analog 
Converters 

8-14 bits , 0. 25%-0.O5% accuracy, . 

+10v, 10ma. , 

Families of converters to meet 
_ application 

20 

Digital to Resol ver/Synchro 
■ Converters 

10-15 bits, 11. 8v, 26v, 90v, 
400hz, 1 min. - 8 min. accuracy. 

« * 

< 

Families' of converters to meet 
applications • 

« , i 4 

* * 
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Digital Multiplexer 


100 Analog Multiplexer 


Minicomputer 


Minicomputer to Analog/, 
; Digital Interface 

1 Minicomputer to Host 
i Computer Interface 


Real Time Clock' 1 


DESCRIPTION 


2000 Digital Input discretes 
2500 Digital output discretes 

FET,. 0-1096 per minicomputer 
channel; to approximately 

1 microsecond switching, 10-200 
nanoseconds aperture with S/A 
amplifiers; relays, 1-10 mliiiseoncl 
switching. 

16 bit word, loss than l.o micro-, 
second cycle time, minimum of 
four operating registers, 

16 bit word parallel transfer, 

11 bit address (2) . 

16 bit word parallel transfer, 

32/16 bit word conversion, transfers 
two real-time clock Interrupts. 

2 outputs pulses programmable, 

0.01$ -accuracy , 0.1 millisecond . 
resolution, 0.001 to 1.0 second, 
range. . • '• 
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APPENDIX B 

A GLOSSARY OF TERMS OF INTEREST FOR , 
SIMULATOR SELF TEST APPLICATIONS 


This Appendix contains definitions of a number of non-obvious specialized 
technical terms of interest to personnel involved in the Simulation Verifi- 
cation Techniques Study. The definitions of words, phrases and acronyms 
given here have been prepared with the aid of general dictionaries, specia- 
lized vocabularies (listed below) and other references. 

In many cases, a word is found with different meanings in different 
sources. In such cases, we have indicated the variety of usage, but 
designated the usage preferred for this study. 

Some notes on format: •' ' 

o Each word or phrase being defined appears once in upper case; cross- 
references to other defined words and phrases are indicated by 
initial caps. 

o Alternate terminologies are often shown together, as CHECKPOINT, 

RESET POINT. 


o Phrases are given in natural order, as CATASTROPHIC FAILURE, 
rather than FAILURE, CATASTROPHIC. 

o A number of abbreviations are used for compactness: usu., usually; 
syn., synonym; cf., compare; e. g., for example. 


B. l SPECIALIZED VOCABULARIES USED IN COMPILING THIS GLOSSARY 

C. 0. Sippl and C, P. Sippl, "Computer Dictionary and Handbook", Howard 
W. Sams & Co. , 1972. 

"Military Standard: Definition of Effectiveness Terms for Reliability, 

Maintainability, Human Factors, and Safety" (MIL-STD-721B)', Dept, of 
Defense, 10 March 1970. 

"Dictionary of Technical Terms for Aerospace Use" (NASA SP-7), National 
Aeronautics and Space Administration, 1965. 

"IEEE Standard Dictionary of Electrical and Electronics Terms" (IEEE 
Std 100-1972, ANSI C42.1 00-1972) , Wi ley-Interscience, 1972, 

"Microprogramming Handbook", Microdata Corp., 1971. 

"International Dictionary of Applied Mathematics," Van Nostrand, 1960. 
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B.2 DEFINITIONS OF WORDS AND PHRASES 

ACCEPTANCE: a formal customer action which affirms that a procured 

article conforms to the agreement under which it was procured (speci- 
fication, purchase order, etc.). (Vendor/contractor obligation often 
continues beyond acceptance; however, vendor normally becomes entitled 
to complete or substantial portion of contracted payment upon acceptance.) 

ACCEPTANCE TEST: a test or series of tests intended to lead to 

acceptance. 

ALIASING: error introduced by sampling a , continuous signal at too low 
a rate. E.g., if the-Nyquist Frequency is 10 Hz, power present at 11, 

29, 31, 49, ... Hz will all contribute to the apparent power at 9 Hz. 
cf. Po 'tier Spectrum, Fourier Transform. (Low-pass filtering before sam- 
pling will reduce or eliminate aliasing.) 

APPLICATION SOFTWARE: software generated by or for a computer user, to 

accomplish the purpose for which the computer was obtained; e. g., 
simulation, 

i 

ASSEMBLER: a Language Processor which translates programs written in 

assembly language into an executable form (typically machine language 
for a particular model computer). 

ASSEMBLY LANGUAGE: a language characterized by the use of .mnemonics 
for operations , operands, and addresses, a one-operation-per-state- 
ment format, and access to most machine hardware features. 

AUTOCORRELATION: -.see Correlation. 

AVAILABILITY: the percentage of its scheduled operational time (e. g., 

first shift) that a system is actually operable. Computed by the formula 

A = 100 x MTBF/-(MTBF + MTTR) , • 

AVERAGING: a technique for filtering uncorrelated noise from repetitive 

signals which are synchronously triggerable'. Cancellation of the random 
noise occurring in different signal periods yields significant improve- 
ments in Signal -to-Noise Ratio. 

BACKUP: intended for use in the event of a failure in primary equipment; 

said of equipment, procedures, etc. Often entails some degradation in 
performance or convenience, cf. Standby. 

BENCHMARK: a program used to evaluate the performance of a computer 
system. 

BODE DIAGRAM, BODE PLOT: a plot of the frequency response of- a linear 
system. Gain in Decibels and phase in degrees are plotted against the 
log of the driving frequency. 
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BUILT-IN-TEST: hardware built in to a system to support Self-Test. 

CALIBRATE: to adjust an apparatus to its design characteristics . 

CATASTROPHIC FAILURE: a sudden failure which results incomplete loss 

of function, equipment damage, or personnel injury. 

CERTIFICATION: formal affirmation that a system is acceptable for its 

intended use; applies to initial certification of a new system, and to 
recertification of a system following modification. 

CHECK CASE: a set of input data and corresponding output' data, which 

provides a standard for evaluation of hardware/software operation. 

CHECKED OUT: having passed a series of tests, and considered to be 

faul t-f ree . 

CHECKOUT: test or monitoring of a system to determine its condition or 

status; sometimes used as syn. for Verification. 

CHECKPOINT, RESET POINT, RESTART POINT, SAFE ‘STORE POINT: a point in. .. 

a- computer program at which data is stored to permit restarting its 
operation. 

CHECKSUM, CHECK SUM: a number formed by addition operations upon a 

set of data (often without regard for carry); used for comparison with 
a reference value, to detect errors in storage, transmission, etc. 

CODE, n: (1) a system of representation .of data and instructions for com- 
puter manipulation, transmission, etc: e. g., BCD, EBCDIC, ASCII. (2) 

the text of a computer program. 

CODE, v: to write out a computer program in an appropriate language; • 

cf. Program. 

COHERENT RADIATION: radiation with fixed or slowly-varying phase rela- 

tionships; e. g., the output of a laser. 

COMBINATIONAL TESTING: a Test Plan whereby a number of tests are performed 

before any results are analyzed. 

COMPILER: a Language Processor which translates high-level compiler- 

language programs into an executable form, or into Assembly language. 
Compiler languages are characterized by symbolic representation of all 
entities and operations, a many-operations-per-statement format, and the 
Transparency of many machine hardware features. 

COMPONENT: a hardware unit which, at a given tier of maintenance, is 

usually replaced rather than repaired, (An irreducible component is 
often called a "piece part 11 ..) 
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CONTROL MEMORY, CONTROL STORE: in a Microprogrammable computer, the 

memory in which microprograms are stored, for use by the Control Unit 
in executing programs from main memory. 

CONTROL UNIT: the part of a computer which controls the 1 sequencing and 

execution of instructions. 

CONVOLUTION: for two time functions 'f and g, the convolution is the 

integral 

f(t) * g(t) = J f(u) g(t-u) du 

J -O0 

provided the integral exists; extremely important in the analysis of 
linear systems. (Convolution in the-time domain corresponds to multi- 
plication in the frequency domain.) 

CORRECTIVE MAINTENANCE: maintenance performed in response to the detec- 
tion or suspicion of a fault. 

CORRELATION: for two random time series f. and f., the Cross-Correlation 

is the integral -j- J 

#3 (t) = j} J/ 1 '"’ f j (t - u) du 

When f. and f . are the same function, the integral ^..(t) is knov'/n as the 
Autocorrelation. 

CRITERION (pi. CRITERIA): (1) a rule or standard for making evaluations 

or decisions. (2) In formal Optimization, a function whose value is to 
be maximized (payoff function) or minimized (cost function); cf. Perfor- 
mance Index. 

CRITICAL DAMPING: see Damping. 

CROSS-ASSEMBLER: an Assembler which executes on one model computer, 

producing code executable on another model computer. 

CROSS-COMPILER: a compiler which executes oh one model computer, producing 

code executable on some other model computer. 

CROSS-CORRELATION: see Correlation. 

DAMPING: dissipation of energy by resistance internal to a system. 

In a second-order linear system, Critical Damping is the value of the 
damping ratio at which motion just ceases to be oscillatory. Systems 
with damping lower and higher than critical are called Underdamped and 
Overdamped, respectively. Cf. Overshoot. 

DATA: numerical or alphabetical material serving as a basis of discus- 

sion or as the object of computer manipulation. In some cases (e. g., 
Checksums, Language Processors) Programs are treated as data. 
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DATA CONVERSION EQUIPMENT (DCE): equipment which changes the- format 
of a signal passing between other pieces of equipment, e. g., A/D, D/A. 

DEBUGGING: detection, isolation and correction of faults in a new system, 

usu. software. Often restricted to superficial errors, such as incorrect 
signs . 

DECIBEL: the usual unit for measurement of gain (amplitude ratio) of a ■- 

linear system (cf. Bode Diagram), and for Signal -to-Noise Ratio. Gain 
in dB = 20 (amplitude ratio). - • 

DIAGNOSTIC: (1) a procedure (often including a computer program) used to 

detect and isolate faults. (2) an error message generated by System 
Software. 

DIRECT MEMORY ACCESS (DMA): Transfer of data between a computer peri- 
pheral device and Main Memory without CPU intervention.* 

DISCRETE EVENT SIMULATION: a form of Simulation in which simulated time 

progresses in accordance with the occurence of events or the performance 
of tasks, rather than in fixed increments. ' 

EMULATION: simulation of the instruction set of one model computer on 

another model computer. Often restricted to simulation approaches 
involving special hardware or "firmware; cf. Interpreter. 

ENERGY SPECTRAL DENSITY: the squared magnitude of the Fourier Transform 

of a "burst" signal (a non-periodic signal of finite duration); cf. Power 
Spectral Density. 

EXECUTIVE: a program which controls the execution of other programs; 

sometimes syn. for Operating System. 

FAIL-SAFE: having the property of counteracting or limiting the effects 

of certain anticipated failure modes. 

FAILURE: unsatisfactory performance or non-performance of a normal function 

or functions (may be the manifestation of a fault, or a response to 
abnormal conditions or loads),.. Sometimes restricted to complete non- 
performance of a function, with "malfunction" used for out-of-spec 
performance. 

FAILURE PREDICTION: analysis of current or historical data from a system 

or component to provide advance warning of hardware failures. Distinguished 
from Periodic Maintenance, which is based upon failure rates for a popu- 
lation of similar hardware units, rather than actual data from a specific 
•unit. 

FAST FOURIER TRANSFORM: a specific algorithm for computation of the dis- 
crete Fourier Transform, which reduces computational requirements dramatically; 
e. g.,, for 1024 data points, the computation time is reduced by about a 
factor of 200. 
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FAULT: a defect or deficiency in a hardware/software system, which will 

lead to failure in some or all circumstances. 

FAULT DETECTION: a positive determination, from testing; or monitoring a 

system, that a fault exists somewhere in the system. 

FAULT INSERTION: deliberate faulting of a hardware/software system or a 

simulation of that system, for the purpose of diagnostic development, 
training, etc. 

FAULT ISOLATION, FAULT LOCALIZATION: determining the location of a fault 

with increasing exactness, i hi s process is normally carried as far as 
is required for remedial action; e. g., Reconfiguration, LRU replacement. 

FIDELITY: actual or perceived accuracy of representation of the real 

world by a simulation. 

FILE MAINTENANCE: modifying the contents of a file, while preserving its 
structure; includes inserting, deleting, modifying and rearranging data. 

FIRMWARE: microprograms in the Control Store of a microprogramable 

computer. 

FORMAT: a specific arrangement or presentation of data, esp. on a 

computer input or output medium. 

FOURIER TRANSFORM: an integral transformation which maps a time series 

into the frequency domain, given by 

F(iw) - ^/e" iw f(t) dt 
The inverse transformation is' 00 



The discrete form of the Fourier transform, used with Sampled data, is 
usually computed using the Fast Fourier Transform. Cf. Power Spectral 
Density, Energy Spectral Density. 

FUNCTIONAL SIMULATION: simulation of the observable effects of some hard- 

ware or software, without requiring representation of internal details. 

GATE: (1) a low-order digital logic element; e. g., an AND gate or OR 
gate. (2) a hardware or software element which produces a discrete 

output based upon the magnitude of an input signal or the occurrence of 
a particular change in the input signal. 

GRAPH: a mathematical construct consisting of nodes and arcs, usu. repre- 

senting the interconnections between elements of a system; see'Fig. B-l . 

IDENTIFICATION, SYSTEM IDENTIFICATION: processing system inputs and out- 

puts to determine values for the parameters of the system. 
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INCIPIENT FAULT DETECTION: see Failure Prediction. ■ 

INFORMATION: (1) that which has the capability to reduce uncertainty; 

(2) the reduction in uncertainty achieved by a particular message, 
measurement, etc.; usu. measured in bits. ~ ! 

INFORMATION THEORY:, the study of messages, codes, transmission lines, etc. 

INTEGRATED SYSTEM(S) TEST; a test conducted with all feasible subsystems, 
of a system interconnected and energized. 

INTERPRETER: a Language Processor which processes and executes computer- 

language text statement-by-statement; normally produces no corresponding 
text in another language. Often used for Emulation. 

LANGUAGE PROCESSOR: a program which operates upon computer-language 

text (programs or individual statements). 

LEAKAGE: "smearing" of spectral lines occurring when the discrete Fourier 

transform is evaluated over a time interval which is not an integral multiple 
of the base frequency of the input signal; cf. Windowing. 

LIBRARY ROUTINES: multi-user routines which are made a part of an Appli- 

cation Software load; e. g.» mathematical and input/output routines. 

LOGGING: recording of data, machine indicators, etc., during the opera- 

tion of a system. May be continuous, periodic, on-command, or triggerred 
by certain events. , 

MAIN MEMORY, MAIN STORAGE: the computer memory from which programs are 

executed. 

MAINTENANCE: activities performed to keep a system operating satisfac- 

torily. See Corrective Maintenance, File Maintenance, On-Condition 
Maintenance, Periodic Maintenance, Preventive Maintenance, Program 
Maintenance. 

MALFUNCTION: see Failure. 

METALANGUAGE: a language used to define and discuss languages. A metalan- 

guage processor is a program used to generate language processors; e. g., 
a meta-assembler generates Assemblers, a meta-compiler (compiler-compiler) 
generates Compilers. 

MICROINSTRUCTIONS: instructions at a lower level of detail, and executed 

at higher speeds, than conventional machine instructions; e. g., a 
single "add" instruction consists of a sequence of microinstructions 
such as comparison, shifts, single-bit adds, and carries. 

MICROPROGRAMMING: programming in terms of microinstructions, on a computer 

which makes microinstructions accessible. 
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MINICOMPUTER: loose! v, any small general-purpose digital computer with 

word length of 15 bits or less. 

MISSION PHASE: a car-ton of a space mission which is defined to begin 

and end with certain srecified events; e. g., the Ascent iphase runs 
from ignition to insertion, the OK-Orbit phase runs from insertion to 
deorbit. 

MODEL: a mathematical! or physical representation of a real-world system; 
6. g., a math model, a scale model* 

MODULAR, MODULARIZED: made up of Interconnected Modules. (A modular 
approach to hard ware/ software often entails sacrifices in terms 

of speed, compactness, and amount of planning required, but returns 
benefits in ease of documentation i modification, verification and repair). 

MODULE: a set of hardware or software elements which are physically 

contiguous, invoked as a unit, arid perform a defined function. 

MODULO: number representation ‘In which the magnitude of every number 

is less than or equal to the magnitude of a fixed number, called the 
modulus," Any number oreater tb^n the modulus is converted to its 
remainder upon division by the modulus; e. g., in modulo-8 arithmetic, 

10, 34, and 586 are all converted to 2. 

MONITOR: to observe and evaluate system inputs and outputs while the 

system is operating; cf. Test. A Iso sometimes used to refer to the collec- 
tion of operating data for later processing, which should properly be 
called Logging. 

MONTE CARLO METHOD: a computational or simulation procedure involving 
' repeated execution of a program, using data sampled randomly from a 
predefined population. 

NYQUIST FREQUENCY, FOLDING FREOUfUCY, TURNOVER FREQUENCY: the highest 

frequency which can be evaluated l»Y f discrete^ Fourier analysis of sampled 
data. The Nyquist frequency is I/2T', where T is the Sampling interval. 

Cf. Aliasing, Sampling Theorem. 

OBSERVABLE: an accessible variahi e which conveys information about the 
dynamics of a system. 

OFF-LINE: independent of a specified system; not under control of that 

system, nor competing with it for resources; separated by time and/or 
space from the system's operation* 

ON-CONDITION MAINTENANCE: see failure Prediction. 

ON-LINE: under control of, contributing to, or competing for resources 
with a specified system. 

OPERATING SYSTEM: System Softv/aro which controls the execution of gobs 
and the allocation of computer f^cources to competing tasks. 
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OPTIMIZATION: (1) selection of the "best" system configuration, parameters 

or procedures. (2) selection of configuration, parameters, or procedures 
to minimize or maximize some objective Criterion function. 

OVERDAMPED: see Damping. : 

OVERSHOOT: the percentage by which the first peak value exceeds the 

steady-state step response of an underdamped system; see Fig. B-2. 

PARAMETER: (1) a quantity which is either constant, or is given a 

constant value for a specific period or process. (2) any quantity 
which is not an independent variable in the dynamics of a system. 

(3) a quantity in the calling sequence of a subroutine or entered 
on a control card. 

PARAMETER ESTIMATION: see Identification. 

PARITY: (1) a Modulo-2 checksum; it has the value 0 if the number of 
ONE bits in the subject data is even, and the value 1 if the number of 
ONE bits is odd. (2) an error-detecting coding scheme in which every 
legal code combination yields the same modulo-2 checksum. Both even- 
parity and odd-parity codes are used. 

PERFORMANCE INDEX: a function of a system's inputs and outputs over a 
given time interval, used as a measure of the quality of system 
behavior; e. g., the integral -square-error (ISE) index is given by: 

I =^/[r(t)-c(t)] 2 dt 

where r(t) is the reference input and c(t) is the controlled output. 

Cf. Criterion. 

PERFORMANCE VERIFICATION: see Validation. 

PERIODIC MAINTENANCE, HARD-TIME MAINTENANCE: Maintenance performed at 

defined time intervals, based upon assumed failure rates and economic 
factors; cf. Failure Prediction. 

PERIPHERAL PROCESSOR: a small computer which performs input/output and 

other service functions for the large computer to which it is attached. 

POINTER: an index or address providing access to instructions or data. 

POWER SPECTRAL DENSITY: the power per unit bandwidth of an input time 
function, as a function of frequency. Computed as the squared magnitude 
of the Fourier Transform; alternatively, the Fourier Transform of the 
Autocorrelation function. Cf. Energy Spectral Density. 

PREVENTIVE MAINTENANCE: Maintenance intended to prevent in-service failures. 

PROGRAM, n: a set of instructions for a computer to perform some specified- 

task. 
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PROGRAM, v: to produce a computer program; includes both design and 

coding. 

PROGRAM MAINTENANCE: modifying an existing program or system of programs, 
while preserving its basic structure; includes error correction, capa- 
bility enhancement, and updating. 

PSEUDO- RAN DOM: generated by a deterministic process, but giving the 

‘appearance of Randomness and satisfying the standard tests for randomness, 
(The output of a pseudorandom sequence generator can be tailored to the 
statistical and/or spectral properties desired for a particular application.) 

RANDOM: occurring by chance rather than by design; unpredictable as to 

the occurrence of a particular event or value, although having certain 
definable statistical properties when considered as an ensemble, 

REAL-TIME COMPUTATION: computation which contributes no time lag to the 

dynamics of a real-world process. 

.REAL-TIME SIMULATION: simulation which proceeds at the same rate as the 

dynamics of the real-world process being simulated. (Man-in-loop 
-simulation is almost always real-time.) 

RECONFIGURE: to change the configuration of a system by activating or 

deactivating On-line or Backup subsystems; often entails some performance 
degradation. Cf. Repair. 

REDUNDANCY: (1) in Codes, the use of characters which do not contribute 

to information content, provided for error detection and possibly cor- 
rection; cf. Parity. (2) provision of more than one means to perform • 
a function; e. g., extra hardware units. Cf. Backup, 

RELIABILITY: (1) the quality of being reliable. (2) the probability 

of acceptable operation, for a specified length of time or for the 
accomplishment of a specified task. 

REPAIR: to restore to service by replacement of parts or by restoration 

of parts to operational condition. 

RESPONSE: a quantitative description 'of the output of a device or system 

■as a function of the input (Stimulus), under conditions that must be 
explicitly stated. 

•RISE 1 TIME: the time required, from the initiation of a Stimulus, for the 

output of a system to rise to a specified fraction (typically 90%) of its 
steady-state value; see Fig. B-2. 

SAMPLING: the process of obtaining a sequence of discrete values of a 

continuous signal, generally at equal time increments; cf. Nyquist 
Frequency. 
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SAMPLING THEOREM: a theorem which proves that a continuous signal v/hich 

has been sampled can be perfectly reconstructed, if the Sampling fre- 
quency is greater than or equal to twice the highest frequency present 
in the original signal. Cf. Nyquist Frequency. 

t 

SELF-TEST: capability of a system (by means of hardware and/or software) 

to perform limited fault detection and isolation without external assist- 
ance; cf. Built-in-Test. 

SEQUENTIAL TESTING: a Test P.lan 'whereby the results of each test are 

analyzed to determine what should be .done next. 

SETTLING TIME: the time required, from the initiation of a Stimulus, 

for the output of a system to enter and remain within a specified narrow 
band centered upon its steady-state value; see Fig. B-2, 

SIGNAL-TO-NOISE RATIO: ratio of the value of a signal to the value of 

the noise; usu. measured in Decibels. (Note that this ratio is commonly 
in terms of peak values for impulsive signals, and in terms of RMS values 
or pov/er for continuous signals.) 

SIMULATION: (1) the representation of real-world phenomena by some 

combination of hardware and software. (2) an assemblage of hardware 
and/or software which can perform simulation; includes pure software 
simulation. 

SIMULATOR: a system providing a physical representation of real-world 

phenomena. (.Our -definition encompasses pure-hardware and hardware/ 
software systems, but excludes pure software simulation (which can only 
generate non-physical representations, such as printouts and plots). 
However, this usage is not universal.) 

SOFTWARE : (1) computer programs. (2) any information contributing 

to computer operation, including programs, data, documentation and pro- 
cedures. 

SOFTWARE PROCESSORS: routines which prepare applications software for 

execution; e. g., Language Processors, loaders, link editors. Cf. 

System Software, 

SPECIFICATION: a document describing an item to be procured or developed. 
(A specification is often the basis of a contract procurement, and there- 
fore written in a manner to facilitate legal enforcement.) 

STANDBY: ready for rapid activation if required. Cf. Backup; Backup 

is a functional assignment, while standby is a mode or status. 

STIMULUS: any change in input that effects 'the output of a system; 

e. g., a disturbance or change in reference input. 

SUBSYSTEM: a System v/hich is part of a larger system. 
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SUPPORT SOFTWARE: software which performs secondary tasks assisting a 

user in accomplishing his primary task; e. g., a simulator organization 
might have support software for simulation-software checkout, generation 
of initial conditions, etc. , 

SYSTEM: (1) an assemblage of hardware and/or software which interacts 

to perform some function or functions. (2) when unmodified, the word 
"system" will normally refer to a simulator, 

SYSTEM CONFIDENCE TEST: a test which, in a reasonably short time, is 

intended to ensure the user that the complete System is operating 
properly, 

SYSTEM SOFTWARE, COMPUTER SYSTEM SOFTWARE: software required for effec- 

tive utilization of a computer for any likely application. Normally 
supplied by the computer manufacturer, but may be modified by the user 
for special applications. See Software Processors, Operating System, 
Library Routines, and Utilities. 

TEST, n: a procedure to evaluate a system under controlled conditions. 

TEST, v: to supply inputs to a system, and then observe and evaluate 

its outputs. Cf. Monitor. 

TEST CASE: see Check Case. 

TEST PLAN: an advance description of the number and order of tests to 

be conducted to accomplish a certain objective (system acceptance, 
diagnosis, etc.). The two main categories are Combinational and 
Sequential Testing. (Combinational strategies tend to be inefficient, 
particularly when system failure rates are low, because many of the 
tests performed are unnecessary. Mixed combinational/sequential 
strategies are often convenient.) Cf. Tree. 

TEST SIGNAL: a Stimulus which is tailored to elicit a known Response 

•from a system, providing a concrete indication of the system condition. 

TIMELINE: a plan (usu. for a space mission) describing a planned sequence 

of events, tasks, etc. 

TIME-SHARING: sharing of computer resources (CPU, storage, I/O channels, 

etc.)' among various tasks, by giving each individual task control of a 
resource for a short time interval — from a few milliseconds to a few 
seconds. 

TRACE: an interpretive diagnostic technique which provides output from 

each computer operation (or each operation of a particular type, such as 
transfers). Often used for software Debugging. 
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TRANSLATOR: a Language Processor which converts text from one computer 

language to another; includes Compilers - and Assemblers. Sometimes used 
to implement Emulation by converting machine language from one model 
computer to another. 

TRANSPARENT: performing functions in such a manner that the user is 

unaware of the underlying implementation; e. g., most computer hardware 
features (registers, channels, etc.) are transparent to a high-level 
language programmer. 

TRAP: a means of interrupting execution v/hen a certain condition occurs 

(e. g., overflow, illegal transfer). 

TREE: a form of directed Graph in which arcs "fan out" from each node, 

so that two paths which originate at different nodes are disjoint; see 
Fig. B-3. (Applications of tree structures include decoders, data manage- 
ment systems and fault-isolation test sequences.) 

TROUBLE-SHOOTING: manual fault isolation, often without a preconceived 
plan. 

UNDERDAMPED: see Damping. 

UNIT: a set of hardware or software elements which performs a defined 

function; cf. Component, Module. . 

UTILITY ROUTINES: multi-user stand-alone routines; e. g., file main- 
tenance, sort/merge. Cf. Library Routines, Support Software. 

VALIDATION: the process of demonstrating that a simulation provides a 

satisfactory representation of the real world. 

VERIFICATION:" the process of demonstrating that a system is capable of 
the satisfactory performance of its intended functions; cf. Checkout. 
Verification is sometimes restricted (esp. in software usage) to refer 
to testing a system against its specifications and other documentation,, 
while Validation refers .to testing agreement- with the real world. 

WINDOWING: time-domain preprocessing of input data before taking its. 

Fourier Transform, for the purpose of 'reducing Leakage. A variety of 
window shapes - triangular, cosine, Hanning, etc. - are in general use. 
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A/D 

ace' 

ACIDS 

AGARD 

AGE 

AIDS 

ALGOL 


DEFINITIONS OF ABBREVIATIONS AND ACRONYMS 
Analog to Digital (conversion) 

Automatic Checkout Equipment, Acceptance Checkout Equipment 

Aircraft Integrated Data System (Army) 

Advisory Group for Aviation Research and Development (NATO) 

Aerospace Ground Equipment; cf. GSE 

Airborne Integrated Data System (commercial airlines) 

Algorithmic Language: a FORTRAN competitor, especially 

in Europe 


ARINC . Aeronautical Radio, Inc. (commercial aviation) 

ASCII American Standard Code for Information Interchange 


ATE 

ATLAS 

ATS 

BASIC 

BCD 


Automatic Test Equipment 

Automatic Test Language for Avionic Systems, Abbreviated 
Test Language. . . 

Automatic Test System 

Beginner's All-purpose Symbolic Instruction Code: a 

programming language widely used in time-sharing systems, 
somewhat simpler than FORTRAN. Used for some ATE. 

Binary - Coded Decimal 


BETA 


Basic English for Test Applications; an ATE programming 
language 


BIT - Built-In Test 

BITA Built-In Test Access: provision of data-paths for effective 

interface with external test equipment 


BITE 

C&D 

CIG 

COBOL 


Built-In Test Equipment 
Control & Display 

Computer Image Generation (also CGI) 
Common Business-Oriented Language 
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CPU 

CRT 

D/A 

dB 

DCE 

DMA 

D/R ' 

DUT 

EASY 

FORTRAN 

EBCDIC 

FDAI 

FFT 

6PATS 

GSE 

HSI 

I/O 

I OS 

ISE 

1ST 

LRU 

MADAR 

MATE 

MCC 

MOPAS 
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Central Processing Unit 

Cathode-Ray Tube 

Digital to Analog (conversion) 

Decibel 

Data Conversion Equipment 

Direct Memory Access 

Digital to Resolver (conversion) 

Device Under Test; cf. UUT 

Engine Analyzer System (Air Force) 

Formula Translation; a popular scientific programming 
language 

Extended Binary-Coded Decimal Interchange Code (IBM) 

Flight Director/ Attitude Indicator 
-Fast Fourier Transform 
General-Purpose ATS 
Ground Support Equipment 
Horizontal Situation Indicator 
Input/Output 

Instructor/Operator Station 
Integral of Squared Error - 
Integrated System Test 

Line-Replaceable Unit (e. g., on the "flight line" or the 
highest tier of maintenance) • or Least Replaceable Unit 

Malfunction Detection, Analysis and Recording (Air Force) 

Multi-band ATE (Navy) 

Mission Control Center 

Matrix-Oriented Production Assembly System 
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MTBF 

MTTR' 

PET 
PL/ 1 

PPU 

PRBS 

PH 

RMS 

ROM 

SCT 

TAEM 

TBO 

uirr 

VAST 
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Mean Time Between Failures or Mean Time Before Failure; 
used in reliability studies 

Mean Time To Restore or Mean Time To Repair; used in 
maintainability studies. The usage "Restore" is pre- 
ferable. 

.Program Evaluator and Tester (formerly PTT) 

Programming Language/I: an IBM FORTRAN/COBOL replacement 

(also PL/1) 

Peripheral Processing Unit 
Pseudo-Random Binary Sequence 
Program Testing Translator (MDAC) 

Root-Mean-Square 
Read-Only Memory 
System Confidence Test 

Terminal -Area Energy Management (Shuttle Mission Phase) 

Time Between Overhauls 
Unit Under Test; cf. DUT 
Versatile Avionics Shop Test (Navy) 
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^ APPENDIX C 

SIMULATOR VERIFICATION TECHNIQUES BIBLIOGRAPHY 

l 

This Appendix provides a list of and subject index- to the several hundred 
documents reviewed during the Hardware Verification Techniques Task Survey.. 

The subject index is Appendix C.l; ihe document list is Appendix C.2 . 

• C.l SUBJECT INDEX TO BIBLIOGRAPHICAL MATERIAL ' 

This subject index is designed to support study technical activities by 
enabling ready access to documents needed by study personnel. Cross-indexing 
information is provided for more effective searching. The indexing approach 
used here was largely derived from experience with DoD and NASA information 
retrieval systems. 

Headings - All terms in this index are given in natural order rather than 
inverted order; e. g., Integrated Circuits rather than Ci rcuits , Integrated . In . 
.a few cases, parenthetical qualifiers are added to clarify the meaning of a term; 
L g . , Debugging (Software) . 

Cross-References - Cross-reference information is now provided within the 
index itself. The objectives of this cross-referencing are as follows: 

c Maintain a degree of reference vocabularly standardization, rather 

than allowing uncontrolled proliferation of terms with similar meanings 
(e. g. } Test, Checkout, Verification). 

© Ease the task of finding relevant documents by balancing the need for 
"clustering" of related documents against the need for "resolution" of' 
differences between related concepts, 

© Illustrate relationships among various indexing terms, as a further 
aid in finding relevant documents. 

Five types of cross-indexing "pointers" are employed in this index: BT, NT, 

RT, Avoid, and Use. "BT" (broader term) and "NT" (narrower term) indicate hier- 
archical scop'e relationships among index terms. "RT" (related term) is not meant 
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imply any indication of the type or degree of relationship' among terms. "Avoid" 
is added after headings whose use is undesirable due to poor resolution, ambiguity 
of definition, or some other reason. Alternative headings will be suggested. A 
document may still be indexed under this heading in some circumstances; e, g., when 
the term appears in the title of the document. Finally, headings marked with an 
asterick are not used as indexing terms. Alternative' terms will be suggested, 
following the word "use". Examples of the various cross-indexing references are 
shown below. 


Computers 

■BT 

Digital Systems 


NT 

IBM Computers, Minicomputers 

Acceptance Tests 

RT 

Verification, Validation 

Checkout 

Avoid 

RT 

Diagnostics, Verification 

Backup* 

Use 

Redundancy 


I Index Entries - The entries under each subject heading identify documents 
"which are known to convey information about that subject. Each entry consists of 
a "retrieval tag" followed by a colon, then a short explanatory comment. The 
retrieval' tag normally consists of the name of the author and date of publication 
of the document (see App. C.2). 
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Acceptance Tests RT Verification, Validation 

J 

B. E. Cowart, 71: SYMBOL computer assemblies 

J. H. Boeckel , 69: Explorer spacecraft 


Adaptive Control 


V. S. Levadi , 66:' learning algorithm for diagnosis 

V. S. Levadi , 65: pattern recognition applied to fault detection 


AIDS* use Onboard Equipment, Data Acquis-ition 

Ai rcraf t 

C. R. Hanke, 70: B747 modeling 

RAeS, 71: flight simulators 

CDU-fiO, 71: FSI DC-10 maintenance 

CDU-MO, 71: JAL 747 maintenance 

CDU-MO, 70: 737 simulator maintenance 

C, R.- . Hanke, 70: B-747 Reference Data 

0. E. Love, 74: YF-12 onboard monitor’ 

M. L. Yaffee, 73: airline ATE 

R. T. Marshall, 73: F-104 dynamics, validation 


^ Airlines 

M. L. Yaffe, 73: airline ATE 

Interavia, 73/6: airline simulator market 

G. J. deWit, 68: airline simulator economics 

B. M. Elson, 72: UAL DC-10 maintenance . 

CDU-MO: airline simulator manuals 


Alignment RT Calibration 

J. P. Vincent, 72: solar simulation 

ATLAS* use Test Languages 

Automation 

F. 0. Hackl, 65: computer maintenance 

J. C. Richards, 68: hybrid computer checkout 

T. Kuroda, 71: MATE 

0. P. Verma, 72: PC board tester 

NYU, 1 966+ : Automation in Test Equipment 

V. S. Levadi, 66: automated learning 

J. E. Fay, 69: automated interface design 

E. F. Meyers, 69: automated checkout for IBM 4-pi 

M. Eleccion, 74: automatic testing overview 
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|J- P. Vincent, 72: array alignment 

ASSC, 72: symposium 

ASSC, 73: symposium 

E. R. Aiken, 73: calibration laboratory 

L. G. Stucki , 72: "PTT" program experience 

L. G. Stucki, 73: Automatic software generation 


use Economics 

use Electronic Equipment, Onboard Equipment 
use Redundancy 
use Test Languages 


A. B. Salisbury, 67: diagnostic programming 

IEEE, 71: vol C-20#l 1 , IEEE transactions 

D. M. Goodman, 67 vol. 4: B.I.T. and Continuous Monitoring 

- E. K. Gannett, 71: dictionary 

ACR, 73: quarterly bibliography 

' H. S.. Dordick, 66: advanced sensing techniques 

P. B. Schoonmaker, 7/73: Verification IRAD (TR-2a) 


Built-in Test 

H. L. Kay, 66: aircraft power systems 

U. R. Furst, 66: avionics 

R. Lund, 72: cars ■ 

R. F. Wokasch, 69: on-board 

A. W. Haydon Co., 72: BITE indicators 

L. A. Whalen, 72: Simulator B.I.T., 

M. A. Mehta, 72: LSI chips 

C. V. Ramamoorthy, 71: blocking gates 


Calibration 

E. R. Aiken, 73: automation 

Cathode Ray Tubes RT Interactive Terminals, Displays &' Controls 

Television 

D. M. Goodman, 67 vol. 3: color 

G. A. McKenzie, 70: TV v/aveforms 

W. C. Bauer, 69: oscilloscope- 

RAeS, 71: in flight simulators 

J. W. Kenney, 72: test methods 
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frheck Cases RT Diagnostics, Test Signals 

M. E. Fowler, 68': using SACCESS 

E. G. Dupnick, 73: minimize number by integer programming ; 

C. R. Hanke, 70: B-747 Reference Data 

Check Sums BT Test Methods 

P. Kreager, 72: CRC 

D. C. Bossen, 72: parity 

J. F. McKevitt, 72: parity 

G. "Audio, 73: parity and CRC 

Checkout Avoi d 

RT Diagnostics, Verification 

K. C. Smith, 68: dual -processor system 

<3. C. Richards, 68:" hybrid computer system 

H. S. Dordick, 66: advanced sensinq techniques 

E. F. Smith, 66: flexible automatic checkout system 

E. F. Meyers, 69: IBM 4- pi 

M&S, 71: SLS options 


Circuit Board s* use Electronic Equipment 

Codes 


S. A. Szygenda, 71: memory error recovery 
G. Audin, 73: parity and CRC 

Combinational Testing* use Test Plans 

Computer Peripheral Equipment 

Computest, 72: disk testing 

J. F. McKevitt, 72: parity for memory testing 

D. Lignos, 72: disks 

G. W. Nelson, 68: on-line peripheral system test 

P. C. .Jackson, 73: integrating ATE peripherals 

Computer System Software RT Support Software, Language Processors 

IBM, S360-20: 0/S debugging 

IBM, S360-25: FORTRAN debug 

UCC, 73: UCC-15 restart management 

H, H, Ipolyi, 73: System software requirements 

W. T. Musial, 73-2: System software survey 
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BT Digital Systems 

NT IBM Computers, Minicomputers, Memories 
N. Bartov/, 70: IBM-360 micro diagnostics 

B. Soucek, 72: minicomputers 1 

A. T. Chen, 73: event trigger 

D. L. Droulette, 71: IBM-360/370 recovery software 

ACR, 73: quarterly bibliography 

P. Kreager, 72: checksum 

J. C. Richards, 68: hybrid 

K. C. Smith, 68: dual -processor checkout system 

B. E. Cowart, 71: SYMBOL computer design 

M. A. Calhoun, 72: SYMBOL computer debugging 

M, J. Flynn, 72: Perspective on Computer' Reliability 

A. Avizienis, 72: Paul t- tolerant, modular computer 

R. S. Chadwick, 73: recovery, redundancy, reconfiguration 

S. A. Szygenda: self-test diagnostics/self-repair 

W.T. Musial, 73-1: computer complex hardware 

V/.T. Musial, 73-2: background survey 

Sci.Amer., 73-4: timing uncertainty, crashes 

L. E. Hart, 71 : "system stethescope" 


C omputers 

\ 


Conferences 


|AA, 73: visual and motion simulation 

71: engineering software verification 

IEEE, 60+: switching circuit theory and logical design 

IEEE, 66: aerospace systems conference 

ASSC: automatic support systems (IEEE) 

IEEE, 71: fault-tolerant computing 

IERE, 70: joint conference on automatic test systems 

RAeS, 71: flight training simulators 

WESCON: electronics, software, etc. 

Configuration Management BT Management 

R. L. Benbow, 73: Simulator management 

NASA, 70: hardware-software end item specifications, interfaces, change 

procedures 

Costs* use Economics 

Cri teri a RT Optimization 

C. V. Ramamoorthy, 72 

R. A. Johnson, 59: examples 

J. Wolkovitch, 62: linear dynamical systems 


C-7 


M CD OW/VEi-L. DOUGLAS ASTfZOfiJAUTtCS COMRfl/VV. EAST 



MDC Ell 50 
1 November 1974 


Cathode Ray Tubes 
Monitoring, Interfaces 


B. Soucek, 72: minis for data acquisition 

H. R. Hegner, 66: sensors 

E. B. Nutt, 65: maintenance recording 

N. A. Landis, 71: software systems for multiple minicomputers 

D. M. Goodman, 67 vol. 4: B.I.T.'and Continuous Monitoring 

St. Louis University, 67: "ACIDS" 

H. S. Dordick, 66: advanced sensing techniques , 

P. C. Jackson, 73: integrating ATE peripherals 

Hewlett Packard, 73: 3050A 

E. Forster, 73: wave form testing 

Dv. J. BVeckr, 73-: digital transient recorder 

Data Bases* * use Data Management 

Data Conversion Equipment* use Interfaces 

Data Links 


PL* 

Data Acquisition 


use 

RT 


Data Industries, Inc.: transmission test set 

Phil co Ford, 73: line test sets 

> Data. Management 

R. L. Benbow, 73: simulator management 

E. K. Gannett, 71: dictionary 

S. L. Prendergast, 72: commercial DBMS’s 

D. Lefkovitz, 69: on-line file structures 

UCC, 73: UCC-15 restart management 

MCAIR, 10/16/72: F-15 Simulator SDRL 

Applied Data Research, 73: "Librarian" 

Data Structures - NT Graphs, Trees 

M. C. Colwell, 71: TREES software package 

0. A. O'Brien, 70: for automatic test systems - 

C. V. Ramamoorthy, 67: graphs for diagnosis 

Independence, 73: decision table processor 

Trilog, 73: decision table compiler 

A. T. Berztiss, 71: graphs, decision tables, etc. 

K. W. Lord, 73: decision tables 

D. Lefkovitz, 69: on-line file structures 
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l Oebugqing (software) RT Programming 

" BT Software Verification 

IBM, S360-20: operating system guide ! 

IBM, S360-25: FORTRAN 

M. A. Calhoun, 72: SYMBOL hardware debugging 

IBM, 72: interactive - FORTRAN, COBOL 

S.A. Szygenda, 70H: software diagnosis 

W. Kocher, 69: Survey 

S&B, 72: SVCINTER 

B. W. Boehm, 70: "SDLab" 

ASME, 71: verification, etc. 

Solutions, Inc., 72: CHKSTOP 

R. Grishman, 70: AIDS on 6600 

Signetics, 72: debug microprograms 

Singer (Link), 73: monitoring; manual procedures; simulators 

E. G. Dupnick, 73: minimize check cases 

CIS, 73: breakpoint module 

Standard Data Corp., 73: COBOL SYM8UG 

Z. Jelinski, 73: spotting known errors 

Standard Data, 74: SYMBUG-F for FORTRAN 

Sider and Associates, 73: TXTM system 

Information Associates, Inc., 73: HEXDSPLY 

E. Fong, 73: compiler diagnostic capabilities 

A. -T. Chen, 73: event trigger 


Decision Tables* use Data Structures 

Del ays* use Timing 

Design Avoid 

use the thing designed; e.g.. Computers, 
Software, -Test Equipment; and/or 
use the design attributes; e.g.. Modular- 
ization, -ilities 

Z. Kohavi , 67: diagnosable sequential machines 

C. V. Ramamoorthy, 71: blocking gates 

M. A. Mehta, 72: BIT on LSI chips 

U. R. Furst,-66: Avionics BIT 

J. E. Fay, 69: interface 

R. A. Marlett, 66: self-diagnosable 

J. L. Ogdin, 72: reliable software 

M. A. Breuer, 68: computer aided design 

D. Mactaggart, 70: test equipment (MELVIN) 
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RT Check Cases, Checkout, Fault Detection, 
Fault Isolation, Self-Test, Test Methods 

H. Jacobowitz, 67: logic-oriented program : 

S. Seshu, 62: asynchronous switching systems 

S. A. Szygenda, 72D: test generation 

C. V. Ramamoorthy , 72: validating diagnostics 

C. V. Ramamoorthy, 67: use of graph theory 

M. A. Mehta, 72: Resolution for LSI 

I. Kohavi, 67: diagnosable sequential machines 

R. E. Forbes, 65: self-diagnosabl e computer 

C. V. Ramamoorthy, 71: fault-tolerant computing 

W. E. Kehret, 72: LSI memory test patterns 

H. 0. Shechtel , 67: missile testing 

R. Lund, 72: cars 

P. A. Hogan, 69: generating test programs 

D. C. Bossen, 72: . parity 

D. Lignos, 72: discs 

S. Seshu, 65: self-diagnosis 

R. A. Marlett, 66: self diagnosable computers 

S. A. Szygenda, 69A: multidimensional paths 

R. A. Johnson, 59: sequential 

N. Bartow, 70: ju- diagnosis on 360-85 

A. B. Salisbury, 67: Bibliography 

P» M. Casey, 70: detection/ isolation programs 

|F. J. Hackl, 65: IBM-360 self-test 

- S. A. Szygenda, 69E: diagnostic generation 

D. E. Alderman, 71: CMPS "PSALT" 

S. A. Szygenda, 71 FT: test generation problems 

S. A. Szygenda, 72SW: diagnostic tests 

Digital Systems NT Computers 

M. A. Breuer, 71: sequential circuits 

R. F. Davis, 72: sequential and combinational circuits 

E. B. Eichelberger, 64: sequential and combinational circuits 

F. C. Hennie, 64: sequential 

IEEE, 60+ : switching- circuit theory symposia 

Z. Kohavi, 67: sequential 

G. R. Putzulo, 71: asynchronous 

J. P. Roth, 67: algorithms to develop diagnostics 

S. Seshu, 62: sequential and asynchronous circuits 

T. F. Miotke, 72: boolean test patterns 

Hewlett Packard, 73: Logic Analyzer 

S. A. Szygenda, 71 W: digital logic simulation 

C. W. Hemming, 72A: modular requirements for digital logic simulator 
S. A. Szygenda, 70S: realtime operation, on-line equipment 

H. D. Caplener, 73: modeling computer hardware 
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fek, Memories* ' use Computer Peripheral Equipment 

Displays & Controls RT Electro-Optical Systems 

ASC Berens , 70: TV, lasers 

Hewlett Packard, 73: Logic Analyzer 

J. Martin, 73: man-computer dialogues 

C. T. Morgan, 63: . human engineering guide 
F. A, Hock, 73: visuals 


Documentation NT Flowcharts, Manuals 

'<1. ToeTlner & Associates, 72: FORDOC for FORTRAN 

D. D. McCracken, 72: readable FORTRAN 

OataPro, 72: flowcharts 

F. McMains, 67: EDIT . ' 

W. Kocher, 69: TIDY, EDIT, Autoflow, etc. 

NASA, 71: guidelines 

6. M. Weinberg, 71:’ requirements, use, structure 


Dynami cs 


RT Simulation, Transient Response, 
Frequency Response 


M. E. Fowler,' 68: difference equations 

R. T. Marshall, 73: F-104 simulation 

R. F. Garzia, 70: fault detection and filtering 

C. R. Hanke, 70: B-747 Reference Data 


R. S. Shirley, 73: "SAFE" (FFT) program 

K. 0. Szalai, 71: airborne simulator 


Economi cs 


G. 0. deWit, 68: simulator utilization 

G. P. Chubb, 69: cost-optimized trees 

R. F. Wokasch, 69: evaluation 

RAeS, 71: simulator training 

R. Braby, 69: cost vs. utilization 

0. H. Boeckel , 69: Explorer spacecraft tests 

Interavia, 6/73: airline simulators 

S. L. Prendergast, 72: commercial DBMS's 
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Electrical Power 

JIAeS, 71: simulator power supplies 

W. F. Huseonica, 65: current measurements 

Electro-Optical Systems RT Displays & Controls 

0. P. Vincent, 72: alignment of solar simulation 

ASC Berens, 70: mainly TV, some lasers 

E. A. Palmer, 73: • night visual for landing 

F. A. Hock, 73: visuals 

AIAA, 73: visual and motion simulation 

L. R. Young, 7.3: visual sensations 

Electronic Equipment NT Digital Systems 

B. M. Elson, 72: avionics 

H. J. Shectel , 67: avionics 

J. P. Verma, 72: circuit boards 

ElecProd, 72: IC testing 

Teradyne, 73: N151 backplane tester 

Failure Detection* use Fault Detection 

Failure Modes RT Reliability 

S. A. Szygenda, 71: memories 

. Vast Fourier Transforms 

W. ,T. Cochran et al , 67: basics 

O. W. Cooley et al , 69: algorithm def. 

E. 0. Brigham, 74: applications 

R. W. Ramirez, 74: error source 

G. D. Berg! and, 69: guided tour of ... 

Fault Detection ' ‘ RT Diagnostics 

M. A. Breuer, 68: problems-for modern hardware 

F. C. Hennie, 64: sequential circuits f 

E. B. Eichelberger, 64: "hazard" detection 

M. A. Breuer, 71: test-generation methods 

J. P. Roth, 67: test-generating algorithms 

V. S. Levadi, 66: automated learning 

H. R. Hegner, 66: passive/indirect sensing 

J. F. McKevitt, 72: parity 

P. M. Casey, 70: diagnostic program 

V. S. Levadi, 65: Pattern recognition 

R. F. Garzia, 70: dynamic systems 

H. A. Cole, 73; failure detection and damping measurement 
D. D. Allen, 73: test digital IC boards 
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^Fault Insertion 

E. V/. Thompson, 73: digital simulation 

S. A. Szygenda, 72F: digital logic simulation 

Z. Jelinski, 73: spotting known errors 

Fault Isolation • RT Diagnostics, Trees 

R. F. Garzia, 71: survey of methods 

<3. P. Roth, 67: logic circuit 

C. V. Ramamoorthy , -67: graphs, trees 

M. A. Mehta, 72: LSI resolution 

V. S. Levadi, 66: automated learning 

Y. V. Lyubatov, 65: time-optimized sequence 

R. A. Johnson, 59: sequential 

P. M. Casey, 70: diagnostic programming 

G. P. Chubb, 69: trouble-shooting 

M. C. Colwell, 71: TREES, software package 

TJB Hannon, 68: cost-optimized trees 

T. K. Elliott, 67: manual trouble-shooting .on MTS-2 

J. P. Rogers, 65: trouble-shooting manual 

R. F. Gar 2 ia, 72: Bode plots 

E. G. Cromer, 73: vendor survey 

W. F. Huseonica, 65: current measurement 

.. W. W. Anderson, 70: "EMMA" 

i 

--' Fault-Tolerant Systems RT SelfrRepair, Reliability 

A. Avizienis, 72: computer reliability 

C. V. Ramamoorthy, 71: summary and overview 

'TEEE, 71: symposium 

F. P. Mathur, 70: hybrid-redundant 

R.B. Conn, 72: fault- tolerant, modular computer 


Filtering 


RT Identification, Frequency Response 


R. F. Garzia, 70: dynamic fault detection' 

H. A. Cole, 73: fault detection 

H. Sriyananda,' 73: selecting test frequencies 

H. J. Rome, 73: inertial platforms 

R. L. Hampton, 65: pseudo-random noise 

Flight Hardware* ' use Onboard Equipment 


Flight Software* 


use Onboard Equipment 
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FI owcharts 


BT Documentation, Graphs 


W. Kocher, 69: software aids 

Data Pro, 72: proprietary packages 

ANSI, 70: flowchart standards 


Frequency Response RT Test Signals, Dynamics, Fast Fourier Transform: 

A. M. Fuchs, 66: automated frequency response ■ 

0. D. Lamb, 70: PRBS input 

J. E. Valstar, 66: sine-wave stimuli 

G. A. McKenzie, 70: TV waveforms 

H. A. Cole, 73: failure detection 

R. F. Garzia, 70: sampled response waveform 

R. F. Garzia, 72: Bode plots 

R. S. Shirley, 73: "SAFE" (FFT) program 

H. Sriyananda, 73: selecting test frequencies 

D. Luttropp, 73: gain-phase meter 

R. C. Darf, 74: modern control theory 

i Graphs BT Data Structures 

NT Flowcharts, Trees 

C. V. Ramamoorthy, 67: use for diagnosis 

J. P. Roth, 67: use in logic diagnostics 

J. A. O'Brien, 70: for Auto-test systems 

0. C. Fakan, 69: review basics 

Z. Manna, 70: termination 

T. W. Pratt, 71: language extension for graphs . 

K. Paton, 71: blocks and cutnodes 

E. G. Dupnick, 73: use for software check cases 

Hardware Avoid 

NT Computers, Test Equipment, Interfaces, etc. 


L. E. Hart, 71: "system stethescope" 

W. T. Musial, 73-1: hardware requirements 

A. T. Chen, 73: event trigger 

B. E. Cowart, 71: SYMBOL hard-wired language processor 

M. A. Calhoun, 72: SYMBOL hardware debug 
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hazards RT Security 

E. B. Eichelberger, 64: in switching circuits 

B. Allen, 68: computer safeguards 


Human Factors 


RT Manual Procedures, Displays and 
Controls, Training 


G. M. Weinberg,, 72: improved programming performance 
G. M. Weinberg, 71: computer programming psychology 
J. Martin, 73: man-computer dialogues 

R. C. Wingrove, 69: pilot -describing functions 

E. A. Palmer, 73: night visual for landing 

NTDG, 69: symposium 

A. Merten, 72: language impact 

Z. Jelinski, 73: spotting known errors 

C. T. Morgan, 63: human engineering guide 


Hybrid Computers* 

use Computers 

Hydraulic Equipment 

RT Motion Systems 

AbM Computers 

BT Computers 

D. L. Droulette, 71: IBM 360 and 370 recovery, software 

N. Bartow, 70: micro-diagnostics for IBM 360 

F. 0. Hockl , 65: IBM 360 self- test 

E. F. Meyers, 69: 4-pi automated checkout 

Identification 

RT Filtering 

J. E. Valstar, 66: 
R. C. Wingrove, 69: 
R. C. Wingrove, 71: 
D. E. Stepner, 73: 

indirect observation 
pilot describing functions 
pilot describing functions 
aerodynamic parameters 

Incipient Failures 

RT Monitoring 

R. F. Barry, 70: failure prediction 

H. A. Cole, 73: damping measurement 
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Information RT Data Management, Codes 

R. A. Johnson, 59: entropy optimization : 


Inputs* use Test Signals 

Integrated Circuits BT Electronic Equipment 

ElecProd, 72: IC testing 

M, A. Mehta, 72: LSI diagnostic resolution 

M. A. Breuer, 68: fault detection problems 

CompDes, 6/73: automated fault detection, isolation 

Computes t, 73: semiconductor testers 

E-. 6'. Cromer, 73: vendor survey 

Fairchild, 73: FAIRTEST 

D. P. Allen, 73: test digital IC boards 


- Integrated Systems 


M. Eleccion, 74: systems 

R. F. Miles, 73: systems concepts 

W. F. Huseonica, 65: current measurements 

interactive Terminals RT Cathode Ray Tubes, Manual Procedures 

IBM, 1972: FORTRAN/COBOL debug 

W. C. Bauer, 69: oscilloscope 

Standard Data, 74: FORTRAN SYM8UG-F 

Interfaces _ ■ - 

0. R. Batchelder: test equipment interfacing 

H. A. Zimmerman, 72: test fixturing- 

J. E. Fay, 69: automated design 

D. E. Alderman, 71: CMPS "PSALT" 

A. T. Chen, 73: event trigger 

J. Martin, 73: man-computer dialogues 
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anguaqe Processors ■ RT Test' Languages , Simulation Languages, 

Support Software 

i 

CHI Corp., 73: Language Implementation System 

M. N. Matelan, 70: BETA-to-BASIC translator' 

E. A. Ehlers, 66: PLACE compiler for GPATS 

Independence, 73: decision table processors 

Trilog, 73: decision table compiler 

M. N. Matelan, 73: test language compiler-compiler 

Standard Data Corp., 73: COBOL SYMBUG 

M. H. Walsh aw, 72: ATLAS— > I DA 

W. Teitleman, 72: BBN-LISP aids 

Datamation, 2/73: FORiRAN compiler verification 

E. Fong, 73: compiler diagnostic capabilities 

B. B. Eiland, 70: Tree Meta study 

Datacraft, 73: Datacraft FORGO 


Launch Vehicles RT Spacecraft, Missiles 


_W. ' F.- Huseonica, 65: current measurements 


1 

Learning* 

use 

Adaptive Control, 

Training 

Logging* 

use 

Data Acquisition, 

Monitoring 

Logi c* 

use 

Digital Systems 


Maintainability 

RT 

Design, Economics 


ASSC: various years 

F. J.- Hackl , 65: IBM 360 

sel f-test 




IEEE, 66+: automatic support systems symposia 

R. A. Johnson, 59: definition of maintainability; suggestions 
H. P. Nicely, 66: reliability and maintainability recording 
ASSC, 73: symposium 

C. T. Morgan, 63: human engineering guide 
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naintenance 


R. F. Barry, 70: failure prediction for preventive maintenance 

T. K. Elliott, 67: manual troubleshooting on MTS-2 

F. 0. Hack!, 65: IBM-360 diagnostics 

E. B. Nutt, 65: maintenance recording 

0. T. Quatse, 65:' time-shared oscilloscope (STROBES) 

R. E. Gunderman, 73: program maintenance 

Sider &- Associates , 73: TXTM system 

Applied Data Research, 73: "Librarian" 

M, L. Yaffe, 73: airline ATE 

CDU-MO, 71: FSI DC-1 0 maintenance 

CDU-MO, 71: JAL 747 maintenance 

CDU-MO, 70": 737 simulator maintenance 

W. W. Anderson, 70: "EMMA" 


Malfunctions* use Failure Modes 

Management - NT Configuration Management 

B. H. L.iebowitz, 67: software specifications 

jESCON , 70: development of large software systems 

. I. E. Butterworth , 73: Quality Assurance for SDM 

D. Smith, Jr., 72: project management 

R. L. Benbow, 73: simulator management 

S. D. Hansen., 73: software quality control 


Manual Procedures 


RT Human Factors, Interactive Terminals 


N. C. Bauer, 69: oscilloscope 

T. K. Elliott, 67: procedural i zed troubleshooting, MTS-2 

M. C. Colwell, 71: TREES software 


Manuals 


BT " Documentation 


CDU-MO, 71: FSI DC-10 maintenance 

CDU-MO, 71: JAL 747 maintenance 

1DU-M0, 70: 737 simulator maintenance 

f. K. Elliott, 67: procedural i zed troubleshooting manual 
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femories BT Computers- 

S. A. Szygenda , 71 R: memory self- test 

J. F. McKevitt, 72: parity 

W. E. Kehret, 72: LSI memory test patterns 

ACL Chiang, 72: semiconductor memory tester 

Mi croprogrammi ng . BT Programming 

RT Computers 

N. Bartow: 360/85 p diagnostics 

Signetics, 72: debugging 


Minicomputers BT Computers 

P. Kreager, 72: checksum 

P. C. Jackson, 73: integrating ATE peripherals 


Missiles RT Launch Vehicles 

,H. J. Shechtel j 67: test equipment for TALOS, etc. 

'■'. -Modelling* use Simulation 

Modul ari zation • RT Design 

A. Avizienis, 72: fault-tolerant, modular computer 

C. W. Hemming, 72A: requirements for digital logic simulation 
W. W. Hinton, 73: simulation software modules 

N. Mirth, 71: stepwise refinement ■ 

M. Iritz, 72: coding and testing 


Monitoring RT Data Acquisition 


P. G. Bookman, 72: computer performance measurement 

H. P. Nicely, 66: in-service failures 

E. B. Nutt, 65: maintenance recording 

U. R. Furst, 66: Avionics B.I.T. 

R. F. Barry, 70: failure prediction 

0. R. Esser, 70: jet engine 
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j. M. Goodman, 67, vol . 4: B.X.T. and- Continuous" Monitoring 

C. Dudl ey’ Warner , 72: computer performance 

B. Miller, 73: failure detection 

W. W. Anderson, 70: "EMMA" 

J. E. Love, 74: YF-12 onboard monitor 

E. Fong, 73: compiler diagnostic capabilities 

AFIPS, 72: computer performance measurement 

Comress, 73: Dynaprobe-8000 

L, E. Hart, 71: "system stethescope" 


Monte Carlo Methods 


M. A. Breuer, 71: random and algorithm for diagnostics 
M. A. Breuer, 72: random and algorithm for diagnostics 
C. Hammer, 67: validating math subroutines 
G, S.- Fishman, 67: simulation validation and verification 


Motion Systems BT Simulators 

RT Hydraulic Equipment 

i. S. Shirley, 73: "SAFE" (FFT) program 

AIAAj 73: visual and motion simulation 

L. R. Young, 73: visual sensation 

On-Board Equipment 

R. F. Wokasch, 69: evaluating onboard tests 

0 . R. Esser, 70: jet engine monitoring 

B. M. Elson, 72: avionics 

H. 0. Shechtel , 67: missile avionics 

B. Miller, 73: failure detection 

Electronics, '1/73: Honeywell 2600 for C-5A 
E. G. Solov, 73: inertial platforms 

H, G. Rome, 73: inertial platforms 

J. E. Love, 74: YF-12 onboard monitor 

VJ. W. Anderson, 70: "EMMA" 
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On-Line Equipment 

}P. A. Hogan, 72: multi-station ATE 

Operating Systems* 

Optimization 

R. A. Johnson, 59: various criteria 

Yu. V. Lyubatov, 65:. minimize average time to localize 
0. H. Boeckel , 69: spacecraft test plans 

E. G. Duphick, 73: integer programming,- softv/are checkout 

D. E. Stepner, 73: aerodynamic parameters 

Oscilloscopes 

W'. C. Bauer, 69: Oscilloscope 

H. Moriyasn et al , 73: digital oscilloscope 

Tektronix, 74: catalog 

Pari ty* use Check Sums 

Pattern Recognition 

D. M. Goodman, 67 vol . 3:' human color CRT 
V. S. Levadi , 65: applied to fault detection 

,CompDes, 6/73: automatic IC fault detection 

IH. Sriyananda, 73: selecting test frequencies 


Performance Indexes* 

use 

Criteria 

Performance Verification* 

use 

Validation 

Peripherals* 

use 

Computer Peripheral Equipment 

Power Supplies* 

use 

Electrical Power 

Production Testing 

■ , BT 

RT 

Testing 

Quality Control 


ElecProd, 72: Automatic backplane testing 

T. Kuroda, 71: automated test system and its language 

J. P. Verna, 72: PC board tester 

E. F. Smith, 66: flexible automatic checkout system 

Computest, 73: semiconductor testers * 

Teradyne, 73: LI 00 series 

R. Kitchen, 70: design impact 

Texas Instruments, 73:. ATS-960 
Teradyne, 73: N151 backplane tester 

Fairchild, 73: FAIRTEST 

ADAR Associates, Inc., 73: memory and LSI testers 

F. Van Veen, 71: IC testing 


RT Time-sharing, Real-Time Operation 
* 

use Computer Sys-tem Softv/are 

i 

RT Criteria 
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Programming BT Software Development 

RT Software Verification 


D. D. McCracken, 72: readable FORTRAN 

CAR Hoare, 72: self-proving programs 

F. McMains, 67: FORTRAN EDIT 

P. A. Hogan, 69: automated diagnostic programming 

A. Merten, 72: language impact 

VI, Teitleman, 72: BBN-LISP aids 

N. M. Cole, 73: plain English 


Proving 


RT Verification 


Elspasj 72: program-proving survey 
Quality Control RT' • Production Testing 

0. E, Butterworth, 71: seminar on 'software 

N. F, Schnei dewind, 72: software reliability 
S, D, Hansen, 73: computer programs 

Random* use Monte Carlo Methods, Test Signals 

Real-Time Operation RT On-Line Equipment, Time-Sharing 


M&S, 71: SLS logging 

Reconfiguration 

0. Goldberg, 66: error control 

A. Avizienis, 72: fault' tolerant, modular computer 

R. S. Chadwick, 73 (IBM): redundancy, reconfiguration 
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Recording* use Data Acquisition, Monitoring 

Recovery '■ 


D. L. Droulette, 71: IBM 360 recovery programming 

G. Oppenheimer, 68: hardware failures, protection 

Solutions, Inc., 72: CHKSTOP 

G. H. Maestri, 72: Retryable Processor 

R. S. Chadwick, 73: redundancy, reconfiguration- 

UCC, 73: UCC-15 restart management 

Redundancy RT Reliability 


G. C. Hendrie, 66: "backup" 

P. Kreager, 72: checksum (CRC) 

F. D. Mathur, 70: self-repair 

A. Avizienis, 72: fault-tolerant, modular computer 
R. S. Chadwick, 73 (IBM): recovery, reconfiguration 

E. G. Solov, 73: inertial platforms 

H. J. Rome, 73: inertial platforms 

Reliability RT Economics 

'G. C. Hendrie, 66: backup 

A. Avizienis, 72: fault-tolerant computing 

6. J. deWit, 68: flight simulator utilisation 

J. Goldberg, 66: logical design techniques 

RAeS, 71: flight simulator reliability 

0. L. Ogdin, 73: software reliability 

J. L. Ogdin, 72: software reliability 

F. P. Mathur, 70: redundancy and self-repair 

H. P. Nicely, 66: in-service MTBF, MTTR, etc. 

N. F. Schneidewind, 72: software reliability 

Z. Jelinski, 71: software reliability research 

J. E. Butterworth, 71: software quality assurance, not "reliability" 


Requi rements 


RT Specifications 


MDEC, 73-1 : visual simulation requirements 

W. T, Musial, 73-1: computer complex requirements 

0. F. Burke, 73-1: simulator hardware requirements 
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/s 

V.- 


Resetting 

P. J. Naples, 67: initializing relay tree 

G. H. Maestri, 72: retryable processor 

Security 


B. Allen, 68: computer safeguards • 

G. Oppenheimer, 68: protection of files 

Self- Repair RT Fault-tolerant Systems 

I. Terris, 65: self-repairing computer 

B. E. Briley, 68: computer control section 

J. Goldberg, 66: logic reconfigurability 

F. P. Mathur, 70: hybrid-redundant 


Self-Test 


B. Allen, 68: HBR- self-test fails with failure 

R. E. Forbes, 65: "DX-l" 

E. F. Meyers, 69: IBM 4-pi 

ACL Chiang, 72: tester self-test 

S . Seshu, 65: improved diagnosis program 

R. A. Marlett, 66: self-diagnosing computers 

F. 0. Hackl , 65: IBM-360 diagnostics 

L, G. Stucki, 73: "PET" program 


Sensitivity 

J. A. Alfieri, 66: logic-circuit design analysis 

Sensors* use Data Acquisition 

Sequential Testing* use Test Plans, Trees 


C-24 

MCDONNEt-L. DOUGt-AS ASTRONAUTICS- CCUVZRANY - EAST 



MDC El 150 
1 November 1974 


Lmulation 


M. E. Fowler, 68: difference equations 1 

R. T. Marshall, 73: F-104 dynamics 

S. A. Szygenda, 72: functional and gate-level simulation 

R. L.T. Hampton, 65: test signals 

E. W. Thompson, 73 (SMU)-t fault insertion 

S. A. Szygenda, ni : fault insertion 

C. W. Hemming, 72A: modular requirements for digital logic' simulation 

S. A. Szygenda, 70S: realtime operation, on-1 ine- equipment 

H. D. Capl ener, 73: modelling computer hardware 

C. R. Hanke, 70: B-747 modelling 

S. A. Szygenda, 71: simulated time flow 


Simulation Languages 

P. B. Dewan, 72: OSSL for computer simulation 

S. A. Szygenda 72: functional simulation software setup 

Simulation Studies 

Lj, Terris, 65: self-repairing computer simulation 

I A. Szygenda, 72sc: functional simulation, gate-level simulation 
J P. Verma, 72: simulating PC boards 

W. T. Musial, 73-2: computer evaluation by simulation 
E. .A. Palmer, 73: night visual for landing 

Simulators RT Training 


G. J. deWit, 68: economics 

RAeS, 71: flight simulators 

T. K. Elliott, 67: MTS-2 

M&S, 71: SLS designs and procedures 

J. P. Vincent, 72: solar simulator alignment 

P. B. Schoonmaker, 73: verification problem areas 

R. T. Marshall, 73: F-104G validation 

Singer, 73: SLS procedures 

J. F. Burke, 73-1: simulator requirements 

J. F. Burke, 73-2: _ simulator baseline 
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MCAI-R, 71 Simulation facility survey 
Interavia, 6/73: airline simulator market 

R. Braby, 69: cost vs. utilization 

W. F. Rhodes, 69: Simulator ATE 

NTDC, 69: symposium 

L. A. Whalen, 72: simulator B.I.T. 

K. 0. Szalai, 71: airborne simulator 

F. A. Hock, 72: visuals 

CDU-MO, 71: FSI DC-10 maintenance 

CDU-MO, 71: DAL 747 maintenance 

CDU-MO, 70: 737 simulator maintenance 

D. E. Alderman, 71: CMPS "PSALT" 

P. B. Schoonmaker, 7/73: Verification 1RAD (T.R-2a) 

Software Development NT Programming 

J. R. Metzner, 67: programming aids 

B. H. Liebowitz, 67: software specifications 

WESCON, 70: management 

TRW, 72: various authors: FSDVF 

N. F. Scheidewind , 72: software reliability 

S. D. Hansen, 73: quality control 

'•■ASHE, 71: verification, etc. 

O. E. Butterworth, 71: quality assurance seminar 

-\). L. Ogdin, 73: software reliability 

0. L. Ogdin, 72: software reliability 

G. M. Weinberg, 72: psychology 

G. M. Weinberg, 72: improved performance 

D. Smith, Jr., 72: project management 

B. B. Eiland, 70: Tree Meta study 

TRW, 72: space program history 

N. Wirth, 71: stepwise refinement 

N. M. Cole, 73: plain English 

M. Iritz, 72: coding and testing 

E. Fong, 73: compiler diagnostic capabilities 

Applied Data Research, 73: "Librarian" 
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Software Verification NT Debugging (software) 

BT Verification 

b. E. Butterworth, 71: quality assurance 

ASME, 71: symposium on engineering software 

Data-Pro, 72: proprietary software testing tools 

C. Hammer, 67: MC validation of math routines 

R. L. Nolan, 72: simulation models 

Synergetics, 72: fas/test for COBOL 

G. M. Weinberg, 71: software tools 

TRW, 7/72: software development • 

Z. delinski, 71: "eutrophication" of errors 

L. G. Stucki, 72: "PTT" program experience 

B. Elspas, 72: program-proving survey 

Datamation, 2/73: FORTRAN compiler verification 

Sider and Associates, 73: TXTM system 

W. C. Hetzel, n/d: program test methods 

G. S. Fishman, 67: simulation validation and verification 

Specifications RT Requirements, Stan 

B. H.. Liebowitz, 67: basis of management 

C. E. Jones, 73: computer and DCE specs. 

Standards RT .Specifications 

tl R M°t7>3pr. 67: 

p! Toellner & Associates, 72: F0RD0C for FORTRAN 

.DoD, 70: NIL-STD-721 B 

NASA, 71: computer program documentation 

ANSI, 70: flowchart standards 

Statistical Techniques* use Monte Carlo Methods, Filtering, 

Optimization 


Statistics 

R. F. Wokasch, 69: a, B decision errors 

Support Software 

Independence, 73: decision table processor 

Trilog, 73: decision table compiler 

S. L. Prendergast, 72: commercial DBMS's . 

L. G. Stucki, 72: "PTT" program experience 

L. G. Stucki, 73: "PET" program 

Sider & Associates, 73: TXTM system 
Information Associates, Inc., 73: HEXDSPLY 

Applied Data Research, 73: "Librarian" 

DataPro, 72: verification tools, flowcharters 

Switches 

S. Givens, 74: FET applications 

L. J. Sevin, -Jr., 65: FET's 
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Switching Circuits* use' Digital Systems 

Systems* use Integrated Systems 

^ Television RT Cathode Ray Tube 

• • 

ASC Berens, 70: mainly TV 

R. Feldt, 68: noise measurement 

D. G- Fink, 57: handbook 

MDEC, 72: state of art 

MDEC, 73-1: simulator requirements 

MDEC, 73-2: proposed approaches 

S. Muth, 74: digitizing video signals 

A. H. Nagler, 71: wide FOV probe 

A. Nagler, 72: Wide FOV probe 

J. Roizen, 73: color cameras 

L. W. Lockwood, M. L. Noble, 70: high resolution TV 

G, A. McKenzie, 74: waveform measurement 

Test Equipment 
IERE, 70: symposium 

B. M. Elson, 72: airline maintenance (UAL DC-10) 

H. J. Shechtel , 67: Navy missile test 

R. Lund, 72: cars 

W. A. Scanga, 69: Navy ATS 

W. C. Bauer, 69: oscilloscope 

-•3. E. Fay, 69: interface 

K. C. L. Chiang, 72: semiconductor memory test 

'■-•Elec Prod, 72: backplane testing 

T. Kuroda, 71: MATE system and its language 

R. J. Meyer, 70: software survey 

K. C. Smith, 68: dual -processor checkout system 

O. R„ Batchelder, 66: interfacing 

E. F. Smith, 66: flexible automatic checkout system 

J. P. Verma, 72: PC board tester 

B. E. Cowart, 71: SYMBOL computer assemblies 

D, Mactaggart, 70: MELVIN 

Elec Prod, 3/73 : good survey 

P. A. Hogan, 72:-, multistation ATE • 

CompDes, 6/73: ;,IC pattern recognition fault detection 

automatic and semi-automatic PCB fault isolation 
W. F. Rhodes, 69: Simulator ATE 

O. Lyman, 73: portable and microprogrammable 

Electronics, 73: Honeywell 2600 for C-5A 

K. J. Stein, 74: shipboard VAST 

E. G. Cromer, 73: vendor survey 

D. P. Allen, 73: test digital IC boards 

P. C. Jackson, 73: integrating ATE peripherals 
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^fest Equipment (Vendors) 

Macrodata, 71: MD-lOO memory tester 

Tektronix, 72: S-3260 

Hewlett-Packard, 72: 9500 series 

Tektronix, 74: catalog 

Data Numerics, 73: continuity tester 

Teradyne; 73: backplane tester 

Hewlett-Packard, 73: IC troubleshooters, probes 

Signetics, 73: debug microprbgrams 

Computest, 73: semiconductor testers 

Teradyne, 73: LI 00 series 

Da*tatron, 73: 4000 series 

Digital General, 73: Model DC- VI I I 

Addison, 73: Auto Tr.ak, self-programming 

Texas Instruments, 73: ATS-960 

Teradyne, 73: N151 backplane tester 

Fairchild, 73: FAIRTEST 

ADAR Associates, 73: memory and LSI testers 

Data Industries, Inc..: transmission test set 

Phil co Ford, 73: line test sets 

Test Languages RT Language Processors 

j). W. Anstead, 70: ATLAS 

-ASSC, 70: VITAL, BETA; surveys 

E. A. Ehlers , 66: PLACE, for GPATS , 

M. T. Ellis, 70: VIiAL and "dialects" 

R. Grishman, 70: AIDS, for debugging 

Hewlett-Packard, 72: ATS BASIC 

ARINC, 72: ATLAS Spec. (416-6) 

W. Kocher, 69: 1 ES 1 RAN, etc. (software debugging) 

M. N. Matelan, 70: BETA-to-BASIC compiler 

R. J. Meyer, 70:' survey of 

M. N. Matelan, 73: test language compiler-compiler 

H. L. Fischer, 72: augmented FORTRAN 

D. MacTaggart, 70: ' MELVIN - assembly language 
T. Kuroda, 71: high-level language for MATE 
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est Methods 


RT Diagnostics 


M. A. Breuer, 71: algorithms 

W. C. Hetzel , n/d: program test methods 

C. V. Ramamoorthy, 72: test validation 

J. P. Roth, 67: algorithms 


Test Patterns* use Test Signals 

Test Plans 


M. A. Breur, 71: sequential 
J. F. Poage, 64: sequential 
J. H. Boeckel , 69: acceptance-test optimization 

E. G. Dupnick, 73: minimize software check cases 

Test Points 


J. A. Alfieri, 66: test logic analysis 

_C. V. Ramamoorthy, 71: "blocking gates" in LSI 

M. A. Mehta, 72: "ambiguity resolver" in PC board 

, - R. Lund, 72: cars 

Test Signals 


T. F. Miotke, 72: Boolean functions, test patterns 

J. D. Lamb, 70: - pseudo-random binary sequence 
RLT Hampton, 65: A/D pseudo random noise generator 

R. C. Wingrove, 69: pilot describing functions 

R. 


R. 

A. 

D. 

H. 

W. 

R. 

S. 


c. 

F. 

J. 

E. 


Darf, 74: testing of control systems 


Garzia, 72: 
Martin, 69: 
Stepner, 73: 
Sriyananda, 73: 
E. Kehret, 72: 
L. Hampton, 65: 
W. Golomb, 67: 


Bode plots 
PRBS's 

aerodynami c parameters 
selecting test frequencies 
LSI memory test patterns 
pseudo-random noise 
shift-register sequences 
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t 

. „st Systems* use Test Equipment 

Testabili ty 

D. C, Bossen, 72: parity network test patterns 

M. A. Mehta, 72: LSI diagnostic resolution 

J. P. Roth, 67: distinguishing between logic failures 

B. E. Cowart, 71 SYMBOL testing aspects - 

R. Kitchen, 70: design impact 

A. Kohavi, 67: diagnosable sequential machines 


Testing Avoi d 

NT Production Testing, Acceptance Tests 

RT Checkout, Diagnostics, Verification, 

Test Methods 


B. E. Cowart, 71: testing SYMBOL computer 

Time-Sharing RT Real-Time Operation, On-Line Equipment 


<3, T. Quatse, 65: 
W. Nelson, 68: 


STROBES: oscilloscope 
on-line peripheral testing 


Tolerances* 


use Sensitivity, Failure Modes 


Training 


RT Simulators, Human Factors 


T. K. Elliott, 67: MTS-2 for troubleshooting 

RAeS, 71: training simulators 

R. Braby, 69: cost vs. utilization 

NT DC, 69: symposium 

Transfer Functions* use Dynamics, Frequency Response 

Transient Response RT Dynamics, Frequency Response 

E. Forster, 73: waveform testing 

D. 0. Blecki, 73: digital transient recorder 
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frees BT Data Structures, Graphs 

RT . Fault Isolation, Flowcharts 

R. F. Davis, 72: combinational/sequential tree circuits 

P. 0. Waples, 67: relay tree 1 

G. P. Chubb, 69: cost-optimized troubleshooting 

TJB Hannon, 68: optimum troubleshooting 

M. C, Colwell, 71: software package 

B. B. Eiland, 70:- Tree Meta study 

N. Wirth, 71: stepwise refinement 

Trouble-Shooting* use Fault Isolation, Manual Procedures 

Validation RT Verification, Acceptance Tests 

ASME, 71: engineering software symposium 

M. E. Fowler, 68: analytic check cases 

R. T. Marshall, 73: F-104G dynamics . . 

R. L. Nolan, 72: simulation models ' . 

R. D. Wright, 72: predictive tests, dynamic models 

K. 0.. Szalai, 71: airborne simulator 

Verification • ' RT Acceptance Tests, Checkout, Diagnostics 

NT Software Verification 

i$. A. Szygenda, 72H: digital system design verification 

P. B. Schoonmaker, 7/73: Verification IRAD (TR-2a) 

Visual Systems RT Displays & Controls, Electro-Optical 

Systems, Cathode Ray Tubes, Television 


M. Aronson, 72: wide angle visuals 

MDEC, 72: survey of technology ' • 

MDEC, 73-1: simulator requirements 

MDEC, 73-2: baseline configuration 

A. H. Nagler, 71: wide angle optical pick-up 

A. Nagler, 72: wide angle optical pick-up 

L. W. Lockwood, R. D. McCafferty, 69: LMS 

L. W. Lockwood, M. L. Noble, 70: high resolution 

R. D. McCafferty, L. W. Lockwood, 70: CMS. visuals 
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t.2 BIBLIOGRAPHIC DOCUMENT LISTING 

The following pages contain a bibliographic listing of all documents 
reviewed during the Hardware Verification Task. These documents are ordered 
and tagged with a retrieval tag which enabled the concise subject cross index 
presented in the previous section. The documents are listed in nominal alpha- 
betical order by authors' name. 
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ACR, 73 (report) 

ADAR Associates , Inc., 
73 

Addison, 73 

ADR, 73 

AFIPS, 72 

AFI'FS, 72 

* 

AIAA, 73 
E.R. Aiken, 73 

D.E. Alderman, 71 

0. A. A1 fieri, 66 

B. Allen, 68 
D.P. Allen, 73 
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BIBLIOGRAPHIC LISTING • 

-A- 

* 

Applied Computer Research, Quarterly Bibliography of 
Computers and Data Processing: A Subject/Author Index ' 

to Computer Literature , Phoenix, Arizona, 1973 

Adar Associates, Inc., Digital Text Systems , Cambridge, 
Mass., 1973 

Addison Electric Company, Addison Auto Trak Self- 
Programming Fault Finder System for Testing - Backplanes , 
HarnessesT and Cables , Bulletin No. AT-3-73-5M, 
Mountainside, New Jersey, 1973 

Applied Data Research, The Librarian: A Source Program 

Maintenance And Retrieval System for IBM System 360/370 ' 
Installations - OS and DOS, Princeton, New Jersey, 1973 

Cureton, H.O., "A Philosophy to System Measurement," 

AFIPS Conference Proceedings , Vol . 41, pages 965-969, 1972 

Rudd, Richard J., "The CPM-X-A Systems Approach to 
Performance Measurement," AFIPS Conference Proceedings, 
Vol. 41, pages 949-957,,' 1972 

"AIAA Visual and Motion Simulation Conference," 

September 10-12, 1973 

Aikin, Robert, and Minck, J.L., "Automating the 
Calibration Laboratory," Hewlett-Packard Journal , 

Vol. 24, No. 8, Palo Alto, California, April, 1973 

Lockheed Electronics Co., "Procedures Simulators 
Analog Linkage Test (PSALT) System," by Alderman, D.E. 
and McGiffin, M.R.~, Vol. 1 and 2, Houston, Texas, 

January, 1971 

Northrop Nortronics Co., "Analytical Approach for 
Determination of Effective Test Logic Des'ign," by 
Alfieri, J.A., Anaheim, California, 1966 

Allen, Brandt, "Danger Ahead! Safeguard Your Computer," 
Reprinted from HBR , Nov. -Dec., 1968 

Allen, Donald P., "Logic Tester Uses Single Trial- 
Procedure to Troubleshoot Digital IC Boards," 

Electronics, Nov .1973 


C-34 


MCOo.'UA/fri.x. oougl/ss ASTRonjAUTics cowpA/yv - m/\s-r 



KEY 

W. W. Anderson , 70 

ANSI , 70 
{std X3 .5-1970) 


0. W. Anstead, 70 
(IERE ppr) 


ARINC, 72 
(spec 416-6) 


M. Aronson, 72 


ASME, 71 


ASSC, 65 
(proceedings) 

ASSC, 68 
(symposium) 

ASSC, 69 
(symposium) 

ASSC, 70 

(symposium record) 
ASSC, 73 

G. Audin, 73 


A. Avizienis, 72 
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NASA, "A Computerized Onboard Expeditious Monitor and 
Maintenance Analyst (EMMA) for Spacecraft Systems 11 , 
by W. W. Anderson-, R. W. Will, TN D-5725 , May 1970 

American National Standards Institute, American 
National Standard Flowchart Symbols and Their 
Usage for Information Processing, New York, 

New York, 1970 

Anstead, J.W. and Challenger, M.2., "The Use of 
ATLAS by an Equipment Manufacturer," IERE Conference 
on Automatic Test Systems , pages 365-371, Cheltenham, 
Gloucestershire, 1970 

Aeronautical Radio, Inc., Abbreviated Test Language 
for Avionics Systems (ATLAS) ARINC 'Specifi cation 
416-6 , October 31 ,1972 

M. Aronson, "A New Assessment of Wide-Angle Visual 
Simulation Techniques", Proceedings of the Fifth 
Naval Training Device Center and Industry Conference, 
NAVTRADEVCEN IH-206, February 15-17, 1972 

American Society of Mechanical Engineers, Pressure 
Vessels and Piping Division, Symposium, On Engineering 
Computer Software: Verification, Qualification , 

Certification, pages 6,7,8,9,61,62, and 63, 1971 

Proceedings of the Automatic Support Systems 
Symposium for Advanced Maintainability , St. Louis, 
Missouri, June 7-8-9, 1965 

Proceedings of the 1968 Automatic Support Systems 
Symposium, S t. Louis, Missouri, Nov. 12-13-14, 1968 

Proceedings of the 1969 Automatic Support Systems 
Symposium, St. Louis, Missouri, Nov. 3-4-5, 1969 

Symposium Record - Automated Support Systems for 
Advanced Maintainability , Nov. 1972 

Automatic Support Systems for Advanced Maintainability , 
(Symposium), Arlington,. Texas, Nov. 5-6-7, 1973 , 

Audin, Gary, "How Are Errors Detected?" Modern Data , 
August, 1973, page 39 

Avizienis, Algirdas, "Computer Reliability and Fault- 
Tolerant Computing" (First International Symposium 
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